Skip to main content
AVOID.NET

StakeDAO

avoid.net/stakedao→20/100·78% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2fMHcu…i6Ay
last updated 2026-08-26

Summary

StakeDAO is a DeFi protocol launched in January 2021 that provides liquid locking, yield strategies, and governance aggregation built primarily around Curve Finance's ecosystem on Ethereum and Arbitrum. On May 27, 2026, the protocol suffered a significant exploit when an attacker compromised its deployer private key and used it to reconfigure a LayerZero v2 OFT bridge peer, enabling the minting of approximately 5.44 trillion vsdCRV tokens on Arbitrum and the extraction of roughly $91,000 in ETH. The incident did not involve a smart contract vulnerability but exposed a critical operational security failure: the deployer key was a single point of failure with no multisig protection, no timelock, and was allegedly operated as a hot key inside automated infrastructure.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about StakeDAO?

Timeline(8 events)

20 January 2021

StakeDAO launched; initial SDT token airdrop distributed representing 1.5% of total supply.

Stake DAO Progress Report Q3 2021

18 April 2026

KelpDAO exploited for approximately $292 million via a compromised LayerZero 1/1 DVN configuration, attributed to Lazarus Group, establishing broader awareness of LayerZero bridge risks.

CoinDesk

9 May 2026

LayerZero publicly acknowledged it 'made a mistake' in permitting its DVN to operate in a 1/1 configuration for high-value transactions, announcing migration to 5/5 or 3/3 DVN minimums.

CoinDesk

27 May 2026

Attacker compromised StakeDAO deployer key (0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62) and executed a setPeer() transaction at approximately 09:17:33 UTC, redirecting vsdCRV LayerZero OFT bridge trust to a malicious contract.

The Block / Memeburn

27 May 2026

Approximately 25 seconds after the setPeer() transaction, a forged LayerZero cross-chain message minted 5,446,744,073,709.551615 vsdCRV tokens on Arbitrum into the attacker's wallet.

Memeburn / Castle Crypto

27 May 2026

Attacker executed approximately 28 swap transactions between 09:17 and 09:43 UTC across Curve, KyberSwap, MetaMask Router, and Enso, converting minted vsdCRV into approximately 43.78 ETH (~$91,000).

Crypto.news / AMBCrypto

27 May 2026

StakeDAO issued public advisory urging users to avoid interacting with vsdCRV tokens. Blockaid confirmed active exploit detection.

Castle Crypto / The Block

28 May 2026

StakeDAO confirmed backing funds secured on Ethereum mainnet, announced permanent shutdown of the vsdCRV Ethereum-Arbitrum bridge, and stated law enforcement and security partners are involved in investigation.

CryptoTimes
Provenance & Audit Trail
Anchored on SolanaVerify on-chain14 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 14 of 15 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 6/30/2026, 5:25:48 PM

last updated: 8/26/2026, 7:06:20 AM

3 views

avoid.net — verified advice for a post-truth world