Defillama founder 0xngmi posted on the X platform stating that a hacker managed to infiltrate one of the addresses in the Lido oracle multisig, exposing their tracks after stealing 1.4 ETH. 0xngmi added that it might be worthwhile to place some simple coins in the multisig wallet to act as a canary and alert when the wallet is compromised.