StakeDAO
Summary
StakeDAO is a DeFi protocol launched in January 2021 that provides liquid locking, yield strategies, and governance aggregation built primarily around Curve Finance's ecosystem on Ethereum and Arbitrum. On May 27, 2026, the protocol suffered a significant exploit when an attacker compromised its deployer private key and used it to reconfigure a LayerZero v2 OFT bridge peer, enabling the minting of approximately 5.44 trillion vsdCRV tokens on Arbitrum and the extraction of roughly $91,000 in ETH. The incident did not involve a smart contract vulnerability but exposed a critical operational security failure: the deployer key was a single point of failure with no multisig protection, no timelock, and was allegedly operated as a hot key inside automated infrastructure.
Connected Entities
1 entities · 10 linked investigationsTimeline(8 events)
2021-01-20
StakeDAO launched; initial SDT token airdrop distributed representing 1.5% of total supply.
Stake DAO Progress Report Q3 20212026-04-18
KelpDAO exploited for approximately $292 million via a compromised LayerZero 1/1 DVN configuration, attributed to Lazarus Group, establishing broader awareness of LayerZero bridge risks.
CoinDesk2026-05-09
LayerZero publicly acknowledged it 'made a mistake' in permitting its DVN to operate in a 1/1 configuration for high-value transactions, announcing migration to 5/5 or 3/3 DVN minimums.
CoinDesk2026-05-27
Attacker compromised StakeDAO deployer key (0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62) and executed a setPeer() transaction at approximately 09:17:33 UTC, redirecting vsdCRV LayerZero OFT bridge trust to a malicious contract.
The Block / Memeburn2026-05-27
Approximately 25 seconds after the setPeer() transaction, a forged LayerZero cross-chain message minted 5,446,744,073,709.551615 vsdCRV tokens on Arbitrum into the attacker's wallet.
Memeburn / Castle Crypto2026-05-27
Attacker executed approximately 28 swap transactions between 09:17 and 09:43 UTC across Curve, KyberSwap, MetaMask Router, and Enso, converting minted vsdCRV into approximately 43.78 ETH (~$91,000).
Crypto.news / AMBCrypto2026-05-27
StakeDAO issued public advisory urging users to avoid interacting with vsdCRV tokens. Blockaid confirmed active exploit detection.
Castle Crypto / The Block2026-05-28
StakeDAO confirmed backing funds secured on Ethereum mainnet, announced permanent shutdown of the vsdCRV Ethereum-Arbitrum bridge, and stated law enforcement and security partners are involved in investigation.
CryptoTimesDecision Log
- hash: 9Rq9Wb1qMZCWqbJiGXKz2MZ3FMdvbmggRhydqJLeCtpy
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/30/2026, 5:25:48 PM
last updated: 6/30/2026, 5:25:57 PM
avoid.net — verified advice for a post-truth world