StakeDAO exploit creates 5.4 trillion vsdCRV but nets only $91K

COINTELEGRAPH · 2026-05-27

An attacker minted more than 5.4 trillion vsdCRV on Arbitrum after a suspected compromise of a StakeDAO-linked deployer key, though thin liquidity limited the realized proceeds to about $91,000. Blockchain security firm PeckShield said Wednesday the attacker swapped part of the minted vsdCRV for 43.7 Ether (ETH), worth about $91,000, and bridged the funds to Ethereum. Onchain analyst EmberCN said the attacker swapped about 16.83 million vsdCRV, while the remaining tokens had little meaningful liquidity to exit. EmberCN estimated the 5.4 trillion vsdCRV at about $763 billion on paper, though the figure does not represent the attacker’s realized profit or the protocol’s confirmed loss. The incident highlights the gap between nominal token values and extractable value in decentralized finance exploits, where attackers can mint enormous token amounts but only cash out what available liquidity allows. In this case, the attacker’s proceeds were limited by the small size of vsdCRV liquidity pools. StakeDAO said it was aware of the incident and warned its users not to interact with vsdCRV. Stake DAO said it was aware of the incident. Source: Stake DAO Shalev Keren, chief product officer and co-founder of crypto key-management firm Sodot, told Cointelegraph that the StakeDAO incident was “structurally similar” to other deployer-key compromises seen this year, including the Wasabi incident last month , which drained about $5.5 million in crypto. Keren said a single StakeDAO deployer key on Arbitrum was used to repoint the vsdCRV cross-chain bridge configuration to an attacker-controlled contract on Ethereum. About 25 seconds later, that contract sent a LayerZero message back to Arbitrum, causing the legitimate Arbitrum token to mint more than 5 trillion vsdCRV to the attacker. Related: Crypto hackers stole $17B over past 10 years: DefiLlama “There is no smart contract bug here and no flaw in LayerZero,” Keren said. “There is one private key, controlling one privileged configuration function, with no multi-signature and no delay between the configuration change going through and the mint clearing onchain.” Keren said the broader issue for DeFi protocols in 2026 is no longer only whether contracts are audited, but whether the operational keys behind those contracts remain single points of failure. Magazine: ETH bears growling, Tom Lee’s buying, XRP to ‘explode’: Market Moves

AI 시장 분석

An exploit on StakeDAO led to the creation of 5.4 trillion vsdCRV tokens, yet the attacker only netted $91K. This incident highlighted significant security vulnerabilities within a DeFi protocol, despite the attacker's limited financial gain.

상승 영향

Blockchain Security — Recurring DeFi exploits increase the demand for smart contract auditing and Web3 security solutions, benefiting companies specializing in these areas.
Traditional Finance — The exposure of DeFi security flaws reinforces the perceived stability of traditional financial assets, potentially attracting risk-averse capital seeking safer investment havens.

하락 영향

DeFi (Decentralized Finance) — Exploits erode trust in the overall DeFi ecosystem, dampening investor sentiment and potentially leading to capital outflows and increased regulatory scrutiny.
Cryptocurrencies (vsdCRV and related tok — The unauthorized creation of 5.4 trillion vsdCRV tokens severely devalues the asset, causing a loss of confidence and potentially impacting related tokens through contagion.

AI가 생성한 분석으로 투자 자문이 아닙니다.

DYAX Investor Sentiment

Bullish (Long) 68% · Bearish (Short) 32%

347 participants

Related News

원문 보기 — COINTELEGRAPH