Stake DAO Exploit Lets Attacker Mint 5.4T vsdCRV on Arbitrum

On May 27, 2026, Arbitrum experienced a significant breach involving Stake DAO, where a hacker minted more than 5.4 trillion vsdCRV tokens by exploiting the token’s cross-chain functionality. This event was logged in block 467160931 at 09:17:58 UTC and utilized the LayerZero v2 Executor. Blockaid pinpointed the issue as a result of a compromised private key belonging to the Stake DAO deployer (0x0007…ff62). By altering the trusted peer in the cross-chain setup to a malicious contract, the attacker sent fake messages to generate tokens. They managed to trade some for about 43.78 ETH (around $91,200) and moved the funds to Ethereum. Stake DAO alerted users about vsdCRV, while Curve Finance advised withdrawals from the asdCRV LlamaLend market due to potential oracle problems. This incident highlights the risks tied to DeFi management, especially for protocols with changeable deployer or admin keys. Stake DAO has not yet published a detailed analysis.