Stake DAO responds to security incident, advises against interacting with vsdCRV for now

Bitget • May 27, 2026

ChainCatcher reported that Stake DAO responded to the security incident on the X platform, stating that its team is aware of the event and advises users not to interact with vsdCRV for now. In addition, there was an abnormality in a contract related to Stake DAO on Arbitrum, resulting in the minting of 5.4 trillion vsdCRV tokens. The security team has classified this as a suspected infinite mint vulnerability exploitation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StakeDAO Exploit: 5.4 Trillion vsdCRV Minted via Compromised Private Key On May 27, 2026, a hacker exploited StakeDAO by compromising its deployer private key, minting over 5.4 trillion vsdCRV tokens on Arbitrum. The attacker swapped a portion of these tokens for approximately $91,000 worth of ETH. StakeDAO, a DeFi protocol, has advised users to cease interactions with vsdCRV immediately. The exploit leveraged a manipulated cross-chain messaging system, allowing the attacker to issue mint commands by replacing the legitimate authorized address. This incident is part of a troubling trend in DeFi exploits, with significant financial losses reported across multiple protocols. StakeDAO's governance token, SDT, saw a 6.6% drop in value following the incident. The exploit's impact extended to Curve Finance, prompting warnings for users with deposits in affected markets. The situation remains ongoing as StakeDAO works on remediation. 6 sources 68

Extracted Entities

Companies (2)

Arbitrum Stake DAO