Stake DAO published its first substantive update on the vsdCRV exploit, roughly 24 hours after an attacker compromised the protocol’s deployer private key and minted 5.4 trillion vsdCRV tokens on Arbitrum.
The key takeaway: the protocol says no mainnet funds were lost to the attacker.
“Preliminary investigation indicates an unauthorised party (attacker) minted vsdCRV on Arbitrum,” Stake DAO wrote on X. “Contributors quickly secured the vsdCRV backing on mainnet (no funds seizable by the attacker) and closed the vsdCRV bridge, containing the impact to Arbitrum.”
What Was Affected — and What Wasn’t
Stake DAO provided a clear breakdown of what remains operational and what does not.
Unaffected: Boosted yields, Liquid Lockers, Votemarket, and Stake DAO lending on Morpho. The protocol said its current assessment shows these core products were not impacted by the exploit.
Affected: The Arbitrum asdCRV Llamalend market is being sunset. Stake DAO directed crvUSD depositors in that market to move their funds to other Llamalend markets. Curve Finance had separately advised users to exit Llamalend positions involving asdCRV on the day of the exploit to avoid liquidation risk.
The vsdCRV bridge between Ethereum and Arbitrum has been permanently closed, meaning no further cross-chain minting or transfers of vsdCRV are possible.
How the Containment Worked
The exploit, first flagged by Blockaid on May 27, involved a compromised deployer key that was used to reconfigure the LayerZero v2 OFT peer on the vsdCRV token contract. The attacker redirected trust from the legitimate Ethereum-side vsdCRVOFTAdapter to a malicious contract, then forged a cross-chain message that triggered unconditional minting of 5,446,744,073,709 vsdCRV on Arbitrum.
The critical detail in Stake DAO’s update is that contributors secured the vsdCRV backing on Ethereum mainnet before the attacker could bridge the exploit back to L1. By closing the bridge, the protocol isolated the damage to Arbitrum—where the attacker had minted trillions of tokens but could only extract approximately 43.78 ETH (~$91,000) due to near-zero DEX liquidity in vsdCRV pools.
Onchain analyst EmberCN had noted on the day of the exploit that vsdCRV pools held only tens of thousands of dollars in liquidity, making the 5.4 trillion minted tokens ($763 billion nominal value) almost entirely unexitable. The containment strategy — securing mainnet backing and cutting the bridge — effectively locked the attacker on the wrong side of the exploit.
Law Enforcement Involved
Stake DAO confirmed that “law enforcement is ongoing, and security partners are involved.” The protocol did not name the security firms or law enforcement agencies but indicated that more details would follow.
This is a notable escalation from the protocol’s initial response on May 27, which consisted only of a brief acknowledgement and a warning not to interact with vsdCRV.
What Remains Open
Stake DAO has not yet published a full post-mortem. Key questions remain unanswered: how the deployer private key was compromised, whether the key was stored in a hardware wallet or hot wallet, why a single deployer key had sufficient permissions to reconfigure the LayerZero OFT peer without multisig approval, and whether any other Stake DAO contracts share similar key management architecture.
The protocol’s TVL stands at approximately $151 million, with only a small portion directly exposed on Arbitrum. The fact that mainnet backing was secured before the attacker could seize it suggests the response team acted quickly—but the underlying question of how a single compromised key could trigger an unlimited mint remains the same vulnerability pattern that has driven the costliest DeFi exploits of 2026.
Also Read: 40+ DeFi Protocols Shut Down in 2026: Inside the $770M Hack Crisis Reshaping Crypto
