Stake DAO Suffers Exploit as 5.4 Trillion vsdCRV Tokens Minted

The decentralized finance platform Stake DAO has confirmed a security breach on the Arbitrum network that resulted in the unauthorized issuance of 5.44 trillion vsdCRV tokens [1]. The protocol’s development team has officially acknowledged the incident and urged users to refrain from interacting with the affected asset while they work to address the vulnerability [1].

Key takeaways

• An attacker minted 5.44 trillion vsdCRV tokens after gaining unauthorized access to a Stake DAO deployer private key [1].
• The attacker successfully converted a portion of the minted tokens into 43.78 ETH, valued at approximately $91,000 [1].
• Security firms confirmed the incident was caused by a compromised credential rather than a flaw in the protocol's smart contract code [1].
• Stake DAO has suspended minting operations and is working with forensic experts to track the movement of funds [1].

Compromise of Privileged Credentials

The exploit originated from the direct compromise of a Stake DAO deployer private key on the Arbitrum network [1]. By obtaining this privileged credential, the attacker was able to modify the configuration of a cross-chain bridge to link a malicious contract they controlled on the Ethereum network [1]. According to Shalev Keren, co-founder of the security firm Sodot, the attacker used this access to send a validation message via LayerZero’s interoperability technology, which deceived the system into triggering the massive, unauthorized minting of tokens [1].

Security analysts noted that the absence of a multi-signature scheme or a time-delay mechanism enabled the attacker to execute the exploit rapidly [1]. Data from Sodot indicates that only twenty-five seconds passed between the modification of the bridge configuration and the minting of the tokens [1]. Following the minting, the attacker began swapping the vsdCRV assets for ETH and moving the funds to the Ethereum mainnet using decentralized bridges [1].

Response and Industry Context

The Stake DAO team has temporarily suspended minting operations to mitigate further damage [1]. They are currently coordinating with infrastructure providers and blockchain forensic firms to monitor the movement of the remaining funds [1]. The team expects to deploy a patched contract on Arbitrum once the compromised key's functions have been fully revoked [1].

This incident follows a broader trend of increased activity targeting decentralized finance protocols. Industry estimates suggest that cumulative losses from exploits in the sector have exceeded $600 million since April 2026 [1]. Analysts have pointed to the use of advanced artificial intelligence tools by attackers as a contributing factor to the rise in these security incidents [1]. The operational pattern observed in the Stake DAO attack has been compared to the exploit suffered by the Wasabi protocol last month [1].