Stake DAO Exploited as Attacker Mints 5.4 Trillion vsdCRV

Stake DAO is currently managing an ongoing security exploit that allowed an attacker to mint over 5.4 trillion vsdCRV tokens on the Arbitrum network [1]. The breach, which was first identified by the blockchain security firm Blockaid, resulted in the unauthorized creation of tokens and subsequent attempts to swap them for ETH [1].

Key takeaways

• An attacker compromised the Stake DAO deployer private key to reconfigure the vsdCRV token contract [1].
• The exploiter minted 5,446,744,073,709 vsdCRV tokens, which carried a nominal value of approximately $763 billion [1].
• Due to limited liquidity, the attacker could only extract about 43.78 ETH, worth approximately $91,000 [1].
• Stake DAO has officially warned users to avoid interacting with vsdCRV until the situation is resolved [2].

Compromised Keys and Fabricated Messages

The attack originated from the compromise of the Stake DAO deployer private key [1]. Using this access, the attacker altered the LayerZero v2 OFT peer configuration on the vsdCRV contract, effectively redirecting trust from the legitimate Ethereum-side adapter to a malicious contract controlled by the attacker [1]. By sending a forged cross-chain message, the exploiter triggered the unconditional minting of 5.4 trillion vsdCRV tokens directly to their address [2].

While the nominal value of the minted tokens was estimated at $763 billion, the attacker faced significant hurdles in converting these assets into usable funds [1]. Because vsdCRV suffers from extremely thin liquidity, the exploiter was forced to systematically exhaust available pools on decentralized exchanges like Curve and KyberSwap [1]. After these efforts, the attacker successfully swapped approximately 16.83 million vsdCRV for 43.78 ETH, leaving the remaining trillions of tokens with no viable market to exit into [1].

Industry Response and Security Concerns

The incident has prompted immediate defensive actions across the decentralized finance ecosystem. Beefy Finance paused a vault that held exposure to Curve and Convex strategies, while Curve issued warnings regarding an affected market on LlamaLend [2]. Stake DAO continues to monitor the situation and has not yet released a full post-mortem or recovery plan [1].

This breach follows a broader trend of private key compromises that have impacted multiple protocols throughout 2026 [1]. Security experts, including Blockaid CEO Ido Ben-Natan, have emphasized that protocols must implement stronger governance controls and real-time on-chain security tooling to validate transactions before they are executed [2]. The exploit has reignited industry discussions regarding the transparency of protocol dependencies and the inherent risks associated with automated yield strategies [2].