Back Cryptobriefing

Stake DAO faces ongoing exploit as attacker mints 5.4T vsdCRV on Arbitrum

Cryptobriefing • May 27, 2026

The attacker was unable to realize meaningful profits due to vsdCRV's extremely thin liquidity.

Stake DAO, a non-custodial liquid staking platform, became the target of a major exploit on Arbitrum after hackers allegedly compromised the protocol’s deployer private key, enabling the minting of more than 5.4 trillion vsdCRV tokens through a manipulated cross-chain messaging infrastructure, according to security firm Blockaid.

🚨 Blockaid detected an ongoing exploit targeting @StakeDAOHQ on Arbitrum.

The attacker just minted over 5.4 trillion vsdCRV and is actively swapping it for ETH.

— Blockaid (@blockaid_) May 27, 2026

Investigators said the attacker took control of the Stake DAO deployer address and altered the LayerZero v2 OFT peer configuration linked to the vsdCRV token contract.

Despite the exploit generating a nominal value estimated at $763 billion, the attacker struggled to convert the tokens into actual cash because of severely limited liquidity in vsdCRV markets.

On-chain analyst EmberCN reported that only 16.83 million tokens were exchanged for 43.7 ETH, or roughly $91,000, before DEX liquidity dried up.

Stake DAO said that they were aware of the situation and warned users not to interact with vsdCRV.

We are aware of the ongoing situation. Please do not interact with vsdCRV.

— Stake DAO (@StakeDAOHQ) May 27, 2026

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StakeDAO Exploit: 5.4 Trillion vsdCRV Minted via Compromised Private Key On May 27, 2026, a hacker exploited StakeDAO by compromising its deployer private key, minting over 5.4 trillion vsdCRV tokens on Arbitrum. The attacker swapped a portion of these tokens for approximately $91,000 worth of ETH. StakeDAO, a DeFi protocol, has advised users to cease interactions with vsdCRV immediately. The exploit leveraged a manipulated cross-chain messaging system, allowing the attacker to issue mint commands by replacing the legitimate authorized address. This incident is part of a troubling trend in DeFi exploits, with significant financial losses reported across multiple protocols. StakeDAO's governance token, SDT, saw a 6.6% drop in value following the incident. The exploit's impact extended to Curve Finance, prompting warnings for users with deposits in affected markets. The situation remains ongoing as StakeDAO works on remediation. 6 sources 68

Extracted Entities

Stake DAO faces ongoing exploit as attacker mints 5.4T vsdCRV on Arbitrum

The full story

Extracted Entities

Companies (2)

CWE Weaknesses (1)

Platforms (1)