Hacker Mints 5.4 Trillion Tokens in StakeDAO Exploit, Nets $91K

Crypto Insight Summary: A hacker compromised StakeDAO's deployer private key on May 27, 2026, using it to mint approximately 5.4 trillion unbacked vsdCRV tokens on Arbitrum and swap a portion for roughly 43.78 ETH (~$91,170), which was bridged to Ethereum. Web3 security firm Blockaid first flagged the attack, reporting that the stolen key was used to replace the legitimate authorized peer address on StakeDAO's LayerZero-based vsdCRV contract, enabling a forged cross-chain mint instruction. Blockchain security firm PeckShield confirmed the conversion and traced the proceeds to Ethereum address 0xeF3C...aa25. StakeDAO, a DeFi protocol with $131 million in TVL that offers boosted Curve Finance yields, warned users to stop interacting with vsdCRV but has not disclosed the total value at risk or a remediation timeline. Its SDT governance token fell approximately 6.6% in the 24 hours surrounding the incident, while SDT trading volume spiked over 400%. Curve Finance urged users to exit its asdCRV LlamaLend market on Arbitrum, warning that the price oracle could be destabilized and trigger unexpected liquidations, while yield optimizer Beefy Finance paused its affected Arbitrum Convex CRV/csdCRV/asdCRV vault and is coordinating with StakeDAO, Curve, and Convex on recovery. The exploit mirrors a pattern of LayerZero OFT standard attacks in which peer configurations are manipulated to forge mint events, similar to the $290 million Kelp DAO bridge exploit in April, though Blockaid attributed the StakeDAO incident specifically to a compromised private key rather than a verifier configuration flaw. On-chain forensics, including the malicious peer deployment, cross-chain mint, and Arbitrum transactions, Crypto Insight Analysis: Direction: Bearish SDT / Neutral CRV Impact: Minor Impact Horizon: Short-term (1-3 days) Reasoning: The exploit caused SDT to drop 6.6% and raised concerns about LayerZero security, but the impact is limited to StakeDAO's ecosystem.