Loading article…
Stake DAO’s Arbitrum protocol was exploited on May 27, minting 5.4 trillion vsdCRV tokens and losing about $91 k before the team froze the market and secured
Stake DAO confirmed that on May 27 an attacker exploited an infinite‑mint vulnerability on its Arbitrum vsdCRV vault, creating roughly 5.4 trillion synthetic tokens and draining about $91 000 in digital assets before the breach was contained [1].
Key takeaways
Preliminary analysis by Blockaid identified an “infinite‑minting” loophole in the vsdCRV vault logic and reward distribution system. The contract accepted an invalid state transition, inflating the token supply by 5.4 trillion units [1]. A separate investigation by PeckShield and Blockaid linked the attack to a compromised Stake DAO deployer key that altered the LayerZero v2 OFT peer configuration, redirecting cross‑chain trust to a malicious contract [3]. This forged message allowed the attacker to mint the massive supply on Arbitrum and swap a portion for ETH, netting about 43.8 ETH before the breach was detected [3].
Stake DAO’s core contributors acted quickly. They secured the vsdCRV backing on Ethereum, deactivated the cross‑chain bridge, and announced that no main‑net funds could be seized by the attacker [1]. The team also announced the permanent sunset of the Arbitrum asdCRV Llamalend market and urged users to avoid interacting with vsdCRV contracts while they relocate capital to unaffected markets [1].
The incident arrives amid heightened scrutiny of DeFi safety, amplified by OpenZeppelin co‑founder Manuel Aráoz’s claim that “all DeFi is unsafe.” Stake DAO’s exploit underscores the ongoing challenges of operational security and cross‑chain trust, rather than a fundamental flaw in the Arbitrum layer‑2 itself [1]. OpenZeppelin responded by emphasizing AI‑driven security research and attributing many recent incidents to operational failures [1].
The attack highlights the vulnerability of cross‑chain token bridges and the potential for a single compromised key to generate massive counterfeit supplies, even when the underlying blockchain remains secure. Stake DAO’s rapid containment limited financial loss to under $100 k, but the incident erodes confidence in vsdCRV and related markets, prompting users to migrate assets and regulators to watch DeFi exploits more closely. Ongoing forensic audits and cooperation with law enforcement aim to trace the stolen ETH and reinforce safeguards against similar attacks in the future.
Coverage is mostly measured — 28 of 35 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
Arbitrum is designed to scale the Ethereum network by handling transactions off-chain, which increases speed and reduces transaction fees for users.
LG Electronics has developed a custom layer-2 blockchain with Arbitrum to automate the placement, buying, and management of digital advertisements.
The ARB token is a governance token that allows holders to vote on decisions regarding the future development of the Arbitrum protocol.
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 3 outlets · Jun 4, 2026 · How we report
No, Arbitrum uses rollups to process transactions off the main Ethereum chain while still utilizing Ethereum's security features.