The Root Cause: A "Dormant" Six-Year-Old Key
According to a detailed statement from the platform's engineering lead, the security alert stemmed from the compromise of an internal private key that had been in use for approximately six years. This key was part of a legacy internal top-up configuration. Its age and potential persistence in older systems introduced the vulnerability, leading to the misdirection of some funds.
Immediate Response and Systemic Remediation
Upon discovery, the technical team enacted a comprehensive emergency protocol:
- Immediate Key Rotation: All production private keys have been rotated, eliminating any further risk from the compromised credential.
- Comprehensive Permission Revocation: All associated access and production permissions linked to the old key have been revoked.
- Architectural Overhaul Planned: Crucially, the platform announced a move away from traditional key storage methods. A full migration of all private keys to a dedicated Key Management Service is underway, representing a foundational upgrade to security infrastructure.
User Fund Safety and Current Platform Status
The statement strongly reassured users regarding safety and operations:
- The platform's core oracle contracts and other primary smart contracts were not exploited or attacked.
- All user funds remain completely secure with no loss of customer assets.
- All platform functions for the prediction market are operating normally, with trading and participation uninterrupted.
This incident underscores the critical importance of internal operational security and key lifecycle management within the DeFi ecosystem. The platform is leveraging this event as a catalyst for a fundamental upgrade to its key management architecture, aiming to build a more resilient foundation of trust.