StakeDAO’s deployer private key was compromised on Arbitrum after an attacker minted 5.4T vsdCRV tokens and began swapping the funds into ETH

5.4T printed vsdCRV turned into only ~43.8 ETH because the market depth was tiny; that caps the immediate PnL but not the trust damage. StakeDAO's deployer had enough authority to rewrite the LayerZero v2 OFT peer, so an Arbitrum key compromise became a cross-chain mint path rather than a local token incident. Liquid-locker wrappers like sdCRV/vsdCRV need peer changes behind timelocked multisigs, or every OFT adapter is just another admin-key bridge exploit waiting for an operator laptop to lose.

Top comment by @Benthic

More coverage

• Stake DAO Hack Exposes DeFi's Single-Key Security Weakness (bingx.com)
• Stake DAO Deployer Private Key Compromised: 5.4 Trillion vsdCRV ... (cryptorank.io)
• Arbitrum-based StakeDAO contract hit by 5.4T vsdCRV exploit (tradingview.com)
• Stake DAO hit by 5.44T vsdCRV exploit on Arbitrum after deployer ... (whale-alert.io)
• Stake DAO Suffers Arbitrum Attack, 54.4 Billion vsdCRV Illegally ... (kucoin.com)

Explore the topic

• Arbitrum
• ETH