Major

Arbitrum

Value

LayerZero

Trillion

StakeDAO, a prominent yield optimization protocol, has become the latest victim of a significant security breach on the Arbitrum network. An attacker exploited a compromised deployer private key to mint approximately <a href="https://arbiscan.io/tx/0x7489ec5f5dba1de6e6c92f2c0f1dd93bd4a2f307c3bd2305b2f93f569a3e5fe5" rel="noopener noreferrer nofollow">5.446 trillion vsdCRV</a> tokens, later swapping a portion for around 43.78 ETH (roughly $91,000) and bridging the funds to Ethereum.
The incident was first flagged by blockchain security platform <a href="https://x.com/blockaid_/status/2059573118927049152" rel="noopener noreferrer nofollow">Blockaid</a>, which detected the unauthorized activity in real time. According to on-chain records, the attacker gained access to the StakeDAO deployer address 0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62. They then reconfigured the LayerZero v2 OFT peer setting on the vsdCRV contract, redirecting it to a malicious contract under their control. This allowed the forging of a cross-chain message that triggered the massive unauthorized mint from the zero address. 
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"> Blockaid detected an ongoing exploit targeting<a href="https://twitter.com/StakeDAOHQ?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@StakeDAOHQ</a> on Arbitrum.
 The attacker just minted over 5.4 trillion vsdCRV and is actively swapping it for ETH.
 More details in <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f9f5.png" alt="🧵">
 — Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/2059573118927049152?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 27, 2026</a>
</blockquote>
The attacker quickly moved to liquidate the newly minted tokens through decentralized exchanges before bridging the extracted ETH to the Ethereum mainnet. The primary attacker wallet on Ethereum is reported as 0xeF3C054d8F7eD0a7D61c8da56ff55F090577aa25.
<h3 id="strong-root-cause-appears-to-be-key-compromise-strong">Root Cause Appears to Be Key Compromise</h3>
Investigations indicate the breach stemmed from a private key compromise rather than a vulnerability in the core smart contract code. The deployer address had reportedly been operating as a hot key in automated infrastructure, which may have increased its exposure.
<a href="https://x.com/StakeDAOHQ/status/2059586800255910039" rel="noopener noreferrer nofollow">StakeDAO has advised users</a> to avoid interacting with vsdCRV tokens for the time being. The protocol’s overall Total Value Locked (TVL) stands at approximately $151 million, with only a relatively small portion directly exposed on Arbitrum.
<h3 id="strong-implications-for-defi-security-strong">Implications for DeFi Security</h3>
This exploit adds to a <a href="https://cryip.co/echo-protocol-on-monad-exploited-hacker-mints-76-7m-fake-ebtc-steals-over-822k/" rel="noopener noreferrer nofollow">growing list of incidents in 2026</a> that highlight persistent challenges around private key management and operational security in decentralized finance. Even projects with strong reputations and multiple audits continue to face risks when critical keys are not properly secured through multisignature setups or cold storage.
Users who have interacted with StakeDAO contracts on Arbitrum are strongly recommended to revoke token approvals as a precautionary step.
This report is compiled independently from publicly available on-chain data and initial disclosures. Further updates are expected once StakeDAO publishes a detailed post-mortem on the incident.

StakeDAO Hit by Major Exploit on Arbitrum, Attacker Mints 5.4 Trillion vsdCRV Tokens

Table of Contents

CRYIP

Other articles published on May 27, 2026

Join our free newsletter for daily crypto updates!