Stake DAO Exploit Shows Why “Audited” Doesn’t Mean Safe In DeFi
The Stake DAO exploit on Wednesday compromised the protocols Arbitrum deployer key. An attacker minted roughly 5.4 trillion fake Vote-Boosted sdCRV (vsdCRV) tokens before swapping them for ether through a public router. The breach bypassed every smart-contract control in place. A single private key with privileged rights has driven hundreds of millions in DeFi losses this year. How the Stake DAO exploit happened On-chain alerts from Blockaid traced the breach to a Stake DAO deployer wallet. The attacker used the key to reset the LayerZero v2 bridge peer for vsdCRV. ???? Blockaid detected an ongoing exploit targeting@StakeDAOHQ on Arbitrum. The attacker just minted over 5.4 trillion vsdCRV and is actively swapping it for ETH. More details in ???? — Blockaid (@blockaid_) May 27, 2026 Roughly 25 seconds later, a forged cross-chain message minted 5.4 trillion vsdCRV on Arbitrum. The attacker dumped the tokens for ether through MetaMasks public router. No smart-contract flaw was found. Notably, a recent LayerZero exploit on KelpDAO occured through similar peer-configuration abuse. A Familiar Pattern of Key Compromises The Stake DAO exploit follows the same template as Aprils Wasabi Protocol drain. A compromised deployer wallet pulled around $4.5 million from vaults on four chains. Drift Protocol lost $285 million on Solana that same month. Arbitrums KelpDAO freeze followed a