Stake DAO was exploited on Arbitrum on Could 27, 2026, when an attacker minted over 5.4 trillion vsdCRV by exploiting the token’s cross-chain configuration. Stake DAO has warned customers to not work together with vsdCRV, whereas Curve Finance additionally advisable that customers with deposits or loans within the asdCRV LlamaLend market on Arbitrum withdraw them to mitigate oracle dangers. On-chain information exhibits that the attacker was solely capable of notice a small fraction of the worth into ETH as a consequence of restricted liquidity.
Exploit Particulars
On-chain information on Arbitrum exhibits that the mint transaction occurred at block 467160931 at 09:17:58 UTC on Could 27, 2026. The transaction recorded roughly 5.45 trillion vsdCRV being minted from the null handle to the pockets 0xeF3C…aa25.
On-chain proof of the Stake DAO exploit. Supply: Arbiscan
This transaction interacted with the LayerZero v2 Executor, indicating that the minting course of was associated to the cross-chain messaging stream used to create tokens on Arbitrum. The mint transaction’s hash is 0x7489…e5fe5, in keeping with Arbiscan information.
Blockaid said that they detected an ongoing exploit focusing on Stake DAO on Arbitrum, during which the attacker minted over 5.4 trillion vsdCRV and started swapping these tokens into ETH.
In response to safety monitoring sources, together with PeckShield, the attacker swapped a portion of the tokens for about 43.78 ETH, price round $91,200 on the time of reporting, after which bridged the belongings to Ethereum. This determine displays the worth initially realized by the attacker, not the nominal worth of the complete minted vsdCRV provide.
Suspected Root Trigger
Blockaid suspects the exploit seemingly stemmed from the Stake DAO deployer’s non-public key being compromised. The deployer handle talked about is 0x0007…ff62.
From this entry, the attacker is believed to have altered the cross-chain configuration that vsdCRV makes use of to validate messages through LayerZero. Particularly, Blockaid stated the attacker modified the trusted “peer” from a sound adapter on the Ethereum aspect to a malicious contract deployed by the attacker, after which used that contract to ship faux messages to mint tokens on Arbitrum.
Suspected root trigger is compromised non-public key.
Malicious peer deployment: https://t.co/RlJlVYC5xeCross-chain mint: https://t.co/NBQdjaTXu0setPeer #3 (earlier than mint): https://t.co/sq7jrH8tN6…Mint tx: https://t.co/kH52CmHXGm…
— Blockaid (@blockaid_) Could 27, 2026
The main points printed by Blockaid point out that the incident concerned deployer permissions and Stake DAO’s LayerZero OFT configuration, reasonably than a confirmed vulnerability inside the LayerZero core protocol. As of the time of writing, Stake DAO has not printed a full autopsy relating to how the non-public key was compromised or the scope of the affected contracts.
This context locations the incident alongside cross-chain messaging dangers that gained consideration following the roughly $292 million Kelp DAO/rsETH incident in April 2026, which additionally concerned message flows by way of LayerZero. The distinction is that within the Stake DAO case, the present information focuses on the undertaking’s compromised key and OFT configuration.
Market and Person Impression
Instantly following the incident, Stake DAO requested customers to not work together with vsdCRV whereas the problem was being dealt with. With over 5.4 trillion new tokens minted, the danger lies not solely within the dilution of the vsdCRV provide but additionally within the affect on liquidity swimming pools, oracles, and protocols linked to this token on Arbitrum.
Curve Finance additionally issued a separate warning for customers with deposits or loans within the asdCRV LlamaLend market on Arbitrum. In response to Curve, the market was nonetheless working usually on the time of the warning, however the value oracle may change into unstable because of the exploit involving vsdCRV, rising the danger of liquidation for borrowing/debt positions.
If in case you have deposits or loans in asdCRV LlamaLend market on Arbitrum – please exist ASAP out of precation.
The market is ok proper now however its value oracle can change into unstable because of the vsdCRV exploit which might trigger liquidations. https://t.co/HhvMfzXEe9
— Curve Finance (@CurveFinance) Could 27, 2026
Regardless of the huge quantity of tokens minted, the worth initially realized by the attacker was solely round $91,200, which is far decrease than the nominal determine as a result of vsdCRV liquidity was inadequate to soak up the complete pool of recent tokens. The ultimate harm nonetheless relies on the quantity of tokens swapped, the extent of affect on associated swimming pools, and the remediation measures from Stake DAO.
What Stays Unclear
Stake DAO had not printed a full autopsy on the time the preliminary warnings had been issued. The remaining open questions embody how the non-public key was compromised, the scope of the affected contracts, the restoration standing of the cross-chain configuration, and the extent of remaining danger to associated swimming pools or markets on Arbitrum.
Within the quick time period, customers concerned with vsdCRV, sdCRV, or markets utilizing associated oracles on Arbitrum nonetheless want to watch official bulletins from Stake DAO, Curve, and on-chain safety entities. The incident additionally highlights key administration dangers in DeFi, particularly for protocols that also permit deployer or admin keys to change belief configurations between chains.
