Loading article…
An attacker minted 5.4 trillion fake vsdCRV tokens on Stake DAO via a compromised private key, draining approximately $91,000 in liquidity on Arbitrum.
Stake DAO is currently addressing the consequences of an ongoing exploit on the Arbitrum network, where an attacker successfully minted over 5.4 trillion fake vsdCRV tokens [1]. While the nominal value of the minted tokens reached approximately $763 billion, the attacker was only able to swap about 16.83 million tokens for 43.78 ETH, worth roughly $91,000, due to extremely thin liquidity on decentralized exchanges [1].
Key takeaways
Blockchain security firm Blockaid was the first to publicly flag the attack, noting that the attacker was actively swapping the illicitly minted tokens for ETH [1]. PeckShield independently confirmed that 5.4 trillion vsdCRV had been minted and that the proceeds were bridged to the Ethereum network [1]. According to Blockaid’s analysis, the exploit originated from the compromise of the Stake DAO deployer private key [1]. The attacker used this access to reconfigure the LayerZero v2 OFT peer on the vsdCRV token contract, redirecting trust from a legitimate adapter to a malicious contract deployed by the attacker [1]. By sending a forged cross-chain message to this malicious peer, the attacker triggered the unconditional minting of 5,446,744,073,709 tokens to their own address [1]. BlockSec’s Phalcon team corroborated this sequence of events, confirming that the attacker set an arbitrary peer to facilitate the attack [1].
Despite the scale of the token generation, the financial impact was limited by the available market liquidity. Onchain analyst EmberCN observed that while the minted tokens held a theoretical value of around $763 billion, the liquidity pools for vsdCRV were only worth tens of thousands of dollars [1]. The attacker systematically exchanged batches of tokens on Curve and KyberSwap, converting approximately 16.83 million vsdCRV into ETH before exhausting the available liquidity [1]. EmberCN drew a parallel to the recent Echo Protocol exploit, noting that similar liquidity constraints prevented the attacker from realizing the full nominal value of the stolen assets [1]. Stake DAO acknowledged the incident shortly after detection, advising users via social media not to interact with vsdCRV [1].
This incident highlights a continuing trend in 2026 where private key compromises, rather than smart contract code bugs, have driven the costliest exploits in the decentralized finance sector [1]. It follows major breaches at Kelp DAO, StablR, and Drift Protocol, all linked to key compromises or social engineering [1]. The exploit comes shortly after OpenZeppelin co-founder Manuel Aráoz publicly stated that he considers "all of " unsafe due to the asymmetry between attackers and defenders [1]. As of the time of reporting, Stake DAO has not yet released a full post-mortem or announced a specific recovery plan for the ongoing exploit [1].
Coverage is mostly measured — 60 of 75 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 1, 2026 · How we report
A DAO is a decentralized autonomous organization that uses blockchain-based software and smart contracts to manage organizational processes like voting and finance.
The legal status of DAOs is generally unclear and varies by jurisdiction, though some states like Wyoming have introduced legislation to recognize them as legal entities.
Because DAO code is difficult to alter once live, fixing security holes often requires writing new code and reaching an agreement to migrate all funds to a new system.
Voting power is typically coordinated through governance tokens or NFTs, where holding a larger quantity of tokens often translates to greater influence over organizational decisions.