What happened
On May 27, 2026, a compromised deployer account that still owned Stake DAO's vsdCRV LayerZero OFT on Arbitrum repointed the token's trusted cross-chain peer to a malicious contract. That peer sent a forged message that minted unbacked vsdCRV, which the attacker swapped through the Arbitrum Curve pool. Stake DAO reports about 43.8 ETH, roughly $91,000, in realized loss; the protocol secured legitimate backing and closed the mint path the same day.
How it happened
- The compromised deployer key used
setPeerto replace the Arbitrum vsdCRV OFT's trusted cross-chain peer with an attacker-controlled contract. - Twenty-five seconds later, the malicious peer delivered a forged LayerZero message that the OFT accepted, minting about 5.45 trillion unbacked vsdCRV.
- The attacker swapped part of that forged supply for about 321,143 CRV and about 7.5 ETH in the Arbitrum Curve pool, then converted the CRV to ETH.
- The attacker bridged 43.776 ETH to Ethereum through Stargate and later deposited 43.9 ETH into Tornado Cash.
- Stake DAO reset the peer, moved ownership and remaining privileged roles to its governance multisig, and secured the legitimate backing within 47 minutes.
Protocol details
Classification
Yield Aggregator / Key Compromise
Protocol Type
Yield
Category
Bridge Hack
Implementation language
Solidity
Protocol links
Website
@StakeDAOHQ
Market Context at Time of Hack
Token Price at Hack
$0.1183
Market Cap at Hack
$8.0M
Reported loss / token market cap
1.13%
Protocol Links
Security review history
- Pashov Audit Group View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
