Arbitrum

Wednesday

LayerZero

Stake DAO

An attacker minted more than 5.4 trillion vsdCRV on Arbitrum after a suspected compromise of a StakeDAO-linked deployer key, though thin liquidity limited the realized proceeds to about $91,000.
Blockchain security firm PeckShield <a href="https://x.com/PeckShieldAlert/status/2059578749352640679" rel="noopener noreferrer nofollow">said</a> Wednesday the attacker swapped part of the minted vsdCRV for 43.7 Ether (ETH), worth about $91,000, and bridged the funds to Ethereum. Onchain analyst EmberCN <a href="https://x.com/EmberCN/status/2059587291950284970" rel="noopener noreferrer nofollow">said</a> the attacker swapped about 16.83 million vsdCRV, while the remaining tokens had little meaningful liquidity to exit.
EmberCN estimated the 5.4 trillion vsdCRV at about $763 billion on paper, though the figure does not represent the attacker’s realized profit or the protocol’s confirmed loss.
The incident highlights the gap between nominal token values and extractable value in decentralized finance exploits, where attackers can mint enormous token amounts but only cash out what available liquidity allows. In this case, the attacker’s proceeds were limited by the small size of vsdCRV liquidity pools.
StakeDAO said it was aware of the incident and <a href="https://x.com/StakeDAOHQ/status/2059586800255910039" rel="noopener noreferrer nofollow">warned</a> its users not to interact with vsdCRV.
<img alt="StakeDAO exploit creates 5.4 trillion vsdCRV but nets only $91K" height="447" src="https://s3-images.ctmedia.io/media/content/pasted-image-157.jpeg" width="882">
Stake DAO said it was aware of the incident. Source: <a href="https://x.com/StakeDAOHQ/status/2059586800255910039" rel="noopener noreferrer nofollow">Stake DAO</a>
<h2 id="incident-points-to-a-deployer-key-compromise">Incident points to a deployer-key compromise&nbsp;</h2>
Shalev Keren, chief product officer and co-founder of crypto key-management firm Sodot, told Cointelegraph that the StakeDAO incident was “structurally similar” to other deployer-key compromises seen this year, <a href="https://cointelegraph.com/news/crypto-hacks-cause-630m-losses-in-april-highest-since-february-2025" rel="noopener noreferrer nofollow">including the Wasabi incident last month</a>, which drained about $5.5 million in crypto.&nbsp;
Keren said a single StakeDAO deployer key on Arbitrum was used to repoint the vsdCRV cross-chain bridge configuration to an attacker-controlled contract on Ethereum. About 25 seconds later, that contract sent a LayerZero message back to Arbitrum, causing the legitimate Arbitrum token to mint more than 5 trillion vsdCRV to the attacker.
Related: <a href="https://cointelegraph.com/news/private-key-compromises-led-crypto-hack-losses-decade" rel="noopener noreferrer nofollow">Crypto hackers stole $17B over past 10 years: DefiLlama</a>
“There is no smart contract bug here and no flaw in LayerZero,” Keren said. “There is one private key, controlling one privileged configuration function, with no multi-signature and no delay between the configuration change going through and the mint clearing onchain.”&nbsp;
Keren said the broader issue for DeFi protocols in 2026 is no longer only whether contracts are audited, but whether the operational keys behind those contracts remain single points of failure.&nbsp;
Magazine: <a href="https://cointelegraph-magazine.com/bitcoin-price-structure-xrp-altcoins-market-moves/" rel="noopener noreferrer nofollow">ETH bears growling, Tom Lee’s buying, XRP to ‘explode’: Market Moves</a>

StakeDAO exploit creates 5.4 trillion vsdCRV but nets only $91K

Table of Contents

Cointelegraph

Other articles published on May 27, 2026

Join our free newsletter for daily crypto updates!