Tydro Protocol Suspends Operations Following Suspected State-Sponsored Oracle Attack

In a significant security incident, Tydro—the largest lending protocol on Kraken's Ink Layer 2—has paused its markets indefinitely. The move came after Chaos Labs flagged suspicious activity on May 4 that strongly suggested a nation-state actor was attacking the protocol's oracle provider. As a result, Tydro is migrating to Chainlink price feeds to restore safe operations. Below, we break down what happened, why it matters, and what users can expect.

What triggered the market pause on Tydro?

On May 4, Chaos Labs—a security firm specializing in DeFi risk—detected abnormal patterns in Tydro's oracle data. The patterns matched behaviors typical of a sophisticated, state-backed attack. Chaos Labs immediately notified Tydro, which decided to pause all lending and borrowing activities as a precaution. The pause remains in effect until Tydro completes a migration to Chainlink price feeds, which are considered more resilient against such high-level threats. Tydro made the announcement on Thursday, confirming that the suspension will last until the switch is fully implemented.

Tydro Protocol Suspends Operations Following Suspected State-Sponsored Oracle Attack — Source: thedefiant.io

Why does Chaos Labs believe this was a nation-state attack?

Chaos Labs observed technical indicators that go beyond ordinary market manipulation or random exploits. The attack patterns included advanced coordination, precise timing, and the use of resources that are typically unavailable to individual hackers or small groups. These signs are consistent with operations conducted by state-sponsored actors, who often have access to vast computational power, insider knowledge of protocol architecture, and the ability to execute multi-layered attacks. While Chaos Labs has not publicly named any specific country, they emphasized that the attack displayed 'patterns similar to those seen in previous state-sponsored campaigns.' Such assessments are rarely made lightly in the DeFi space, underscoring the severity of the threat.

How is Tydro responding to the attack?

Tydro’s primary response is to migrate from its current oracle provider to Chainlink price feeds. Chainlink is a decentralized oracle network known for its security, transparency, and resistance to manipulation. The migration process involves integrating Chainlink’s data oracles into Tydro’s smart contracts, ensuring that all price references are sourced from multiple independent nodes. During this transition, all markets remain paused to prevent any exploitation of the vulnerable oracle. Tydro is also working with security experts like Chaos Labs to audit the new infrastructure before resuming operations. The protocol has not announced a specific completion date, but it assured users that the migration is a top priority.

What are Chainlink price feeds and why are they safer?

Chainlink price feeds are off-chain data points aggregated from numerous high-quality sources and delivered on-chain via a network of decentralized oracles. Unlike centralized oracles, which are single points of failure, Chainlink uses multiple independent node operators to fetch, validate, and report asset prices. This makes it extremely difficult for any single attacker—even a state-backed one—to manipulate price data. Additionally, Chainlink’s reputation system and staking mechanisms incentivize honest behavior. For Tydro, switching to Chainlink reduces the risk of price manipulation that could lead to faulty liquidations or borrows. Many top DeFi protocols already rely on Chainlink, making it a trusted standard in the industry.

What does this mean for Tydro users?

Current users of Tydro cannot deposit, borrow, or liquidate positions until markets resume. However, existing positions remain frozen, meaning no one can be unfairly liquidated during the pause. This protects users from potential losses that could occur if a manipulated oracle triggered false price spikes or drops. Once the Chainlink migration is complete, Tydro will reopen markets and allow users to interact normally. Users are advised to monitor official Tydro channels for updates on the migration timeline. No funds have been reported lost due to the attack, as the protocol acted quickly to halt operations. For those who had assets on Tydro, patience is required while the security upgrade is finalized.

When will Tydro markets reopen?

Tydro has not provided a specific date for reopening. The timeline depends on the complexity of the migration to Chainlink price feeds and the completion of security audits. The protocol stated that it will keep markets paused until the migration is fully done and tested. While some estimates suggest it could take days to weeks, no official deadline has been set. Users should expect regular updates from Tydro via their blog or social media. In the meantime, the pause serves as a safety measure—better to keep markets closed than risk a catastrophic oracle exploit. Once Chainlink oracles are live and verified, Tydro will announce the resumption of lending and borrowing activities.