Attacker Mints 5.4T Tokens in Stake DAO Arbitrum Exploit

Stake DAO is currently addressing the consequences of an ongoing exploit on the Arbitrum network, where an attacker successfully minted over 5.4 trillion fake vsdCRV tokens [1]. While the nominal value of the minted tokens reached approximately $763 billion, the attacker was only able to swap about 16.83 million tokens for 43.78 ETH, worth roughly $91,000, due to extremely thin liquidity on decentralized exchanges [1].

Key takeaways

• An attacker minted 5.4 trillion vsdCRV tokens on Arbitrum using a compromised deployer key [1].
• Approximately $91,000 was drained from liquidity pools, significantly less than the tokens' nominal value [1].
• Stake DAO has warned users not to interact with the vsdCRV token [1].
• The exploit involved reconfiguring a LayerZero v2 OFT peer to enable unconditional minting [1].

Compromised Key Triggers Cross-Chain Minting

Blockchain security firm Blockaid was the first to publicly flag the attack, noting that the attacker was actively swapping the illicitly minted tokens for ETH [1]. PeckShield independently confirmed that 5.4 trillion vsdCRV had been minted and that the proceeds were bridged to the Ethereum network [1]. According to Blockaid’s analysis, the exploit originated from the compromise of the Stake DAO deployer private key [1]. The attacker used this access to reconfigure the LayerZero v2 OFT peer on the vsdCRV token contract, redirecting trust from a legitimate adapter to a malicious contract deployed by the attacker [1]. By sending a forged cross-chain message to this malicious peer, the attacker triggered the unconditional minting of 5,446,744,073,709 tokens to their own address [1]. BlockSec’s Phalcon team corroborated this sequence of events, confirming that the attacker set an arbitrary peer to facilitate the attack [1].

Thin Liquidity Caps the Financial Damage

Despite the scale of the token generation, the financial impact was limited by the available market liquidity. Onchain analyst EmberCN observed that while the minted tokens held a theoretical value of around $763 billion, the liquidity pools for vsdCRV were only worth tens of thousands of dollars [1]. The attacker systematically exchanged batches of tokens on Curve and KyberSwap, converting approximately 16.83 million vsdCRV into ETH before exhausting the available liquidity [1]. EmberCN drew a parallel to the recent Echo Protocol exploit, noting that similar liquidity constraints prevented the attacker from realizing the full nominal value of the stolen assets [1]. Stake DAO acknowledged the incident shortly after detection, advising users via social media not to interact with vsdCRV [1].

Why it matters

This incident highlights a continuing trend in 2026 where private key compromises, rather than smart contract code bugs, have driven the costliest exploits in the decentralized finance sector [1]. It follows major breaches at Kelp DAO, StablR, and Drift Protocol, all linked to key compromises or social engineering [1]. The exploit comes shortly after OpenZeppelin co-founder Manuel Aráoz publicly stated that he considers "all of " unsafe due to the asymmetry between attackers and defenders [1]. As of the time of reporting, Stake DAO has not yet released a full post-mortem or announced a specific recovery plan for the ongoing exploit [1].