Word is the team hasn't pinned down a single attack vector yet—classic ops-security breakdown. Here's the kicker: they've basically admitted to consolidating 10 out of 12 validators onto a single machine. That's a centralization nightmare waiting to happen. When you stack that many validators in one place, you're not dealing with external project dependencies anymore—it's purely on them. The infrastructure risk sits squarely with their architecture choices, not any third-party factor.