← StakeDAO — vsdCRV Deployer Key Exploit (May 2026)reviewed 2026-10-17 · 31 claims checked
Fact-check findings
What an automated fact-checker found when it re-read StakeDAO — vsdCRV Deployer Key Exploit (May 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #25[disputed][awaiting moderator]in section: Law Enforcement and Ongoing Investigation
“As of the post-mortem publication date (June 9, 2026), the approximately 43.78 ETH extracted by the attacker reportedly remained untouched on Ethereum mainnet.”
reviewerAs of the post-mortem publication date (June 9, 2026), the ~43.78 ETH extracted by the attacker reportedly remained untouched on Ethereum mainnet.This sentence contradicts the very next sentence in the same section ('The proceeds were subsequently deposited into Tornado Cash in multiple transactions on May 31, 2026') and the page's own timeline entry dated 2026-05-31. By June 9 the ETH had already been laundered, so it could not have 'remained untouched' as of that date; this appears to be an 'untouched funds' detail from earlier reporting mis-anchored to the later post-mortem date.Proposed correction (not yet applied)Shortly after the exploit, the approximately 43.78 ETH extracted by the attacker reportedly remained untouched on Ethereum mainnet, before being moved into Tornado Cash on May 31, 2026.
unverifiable
7 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: Background: StakeDAO and vsdCRV
“StakeDAO is a DeFi yield optimization protocol, incorporated in Switzerland, that allows users to earn boosted yields on Curve Finance liquidity pools through locked CRV positions.”
reviewerStakeDAO is a DeFi yield optimization protocol incorporated in Switzerland.No primary corporate-registry source found confirming a Swiss legal entity for StakeDAO specifically. Circumstantial support exists: its founding firm Stake Capital is headquartered in Zug, Switzerland, and StakeDAO's own post-mortem says it filed its criminal complaint with Swiss authorities, but neither is a direct confirmation of incorporation. - #12[unverifiable][awaiting moderator]in section: Financial Impact
“Only approximately 16.83 million vsdCRV tokens could be converted to ETH before liquidity pools were exhausted.”
reviewerOnly approximately 16.83 million vsdCRV tokens could be converted to ETH before liquidity pools were exhausted.Plausible given the ~43.78 ETH realized and thin liquidity narrative, but could not be independently confirmed from the accessible text of either cited source. - #15[unverifiable][awaiting moderator]in section: Financial Impact
“StakeDAO's SDT governance token declined approximately 6.6–7% in the 24-hour period surrounding the incident, with SDT trading volume spiking more than 400%.”
reviewerStakeDAO's SDT governance token declined approximately 6.6-7% in the 24-hour period surrounding the incident, with trading volume spiking more than 400%.Plausible and consistent with a secondary aggregator summary found in search, but could not be confirmed directly from the text of any cited source after fetching. - #18[unverifiable][awaiting moderator]in section: Immediate Incident Response
“Curve Finance recommended that users with deposits or loans in the asdCRV LlamaLend market on Arbitrum withdraw their funds to mitigate oracle-manipulation risk.”
reviewerCurve Finance recommended asdCRV LlamaLend users on Arbitrum withdraw funds to mitigate oracle-manipulation risk.Could not independently confirm this specific Curve Finance recommendation; the cited article was inaccessible (Cloudflare challenge page). - #19[unverifiable][awaiting moderator]in section: Immediate Incident Response
“The Arbitrum asdCRV LlamaLend market was placed into sunset mode, with users directed to migrate to other Llamalend markets.”
reviewerThe Arbitrum asdCRV LlamaLend market was placed into sunset mode, with users directed to migrate to other Llamalend markets.The cited post-mortem coverage describes the LlamaLend market as safeguarded rather than confirming the specific 'sunset mode' terminology and migration directive used on the page. - #23[unverifiable][awaiting moderator]in section: Compensation and Governance Response
“A subsequent proposal, SDGP-75, extended ex gratia compensation to borrowers on the Arbitrum asdCRV LlamaLend market who suffered unfair liquidations as a result of the vsdCRV price collapse during the exploit. Both proposals passed governance voting.”
reviewerSDGP-75 extended ex gratia compensation to asdCRV LlamaLend borrowers unfairly liquidated during the exploit, and both proposals passed governance voting.SDGP-75's purpose is confirmed, but neither proposal's final passage could be independently verified; for SDGP-70, forum replies imply the claim portal went live (weak indirect evidence of passage), but no explicit pass confirmation was found for SDGP-75. - #31[unverifiable][awaiting moderator]in the timeline
“SDGP-75 voting concludes, extending ex gratia compensation to Arbitrum asdCRV LlamaLend market borrowers unfairly liquidated during the vsdCRV price collapse on May 27.”
reviewerSDGP-75 voting concludes on 2026-08-03, extending ex gratia compensation to Arbitrum asdCRV LlamaLend borrowers unfairly liquidated during the vsdCRV price collapse.The August 3, 2026 date is a reasonable arithmetic inference from the posting date and stated voting schedule, but is not stated outright in the source, and no vote result/tally was found.
partially supported
6 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in the summary
“StakeDAO passed a voluntary governance proposal (SDGP-70) to compensate 242 affected addresses with 1,535,421.76 sdCRV and filed a criminal complaint with Swiss authorities.”
reviewerStakeDAO passed SDGP-70 to compensate 242 affected addresses with 1,535,421.76 sdCRV, and filed a criminal complaint with Swiss authorities.The sdCRV amount and the Swiss complaint are confirmed, but the source document itself gives two different address counts (294 and 242) without reconciling them; the page states only one without flagging the discrepancy. - #10[partially supported][awaiting moderator]in section: Attack Mechanism: LayerZero Peer Hijack and Forged Cross-Chain Mint
“Proceeds were swapped across Curve Finance and KyberSwap DEX pools, and the resulting ETH (~43.78 ETH) was bridged to Ethereum mainnet via Stargate and Relay bridges, then deposited into Tornado Cash in multiple transactions on May 31, 2026.”
reviewerProceeds were swapped across Curve and KyberSwap, bridged to Ethereum via Stargate and Relay bridges, then deposited into Tornado Cash in multiple transactions on May 31, 2026.The DEX swap and Tornado Cash deposit details are corroborated; the specific naming of 'Stargate and Relay bridges' was not found verbatim in any source checked, though 'bridged to Ethereum' generally is confirmed. - #21[partially supported][awaiting moderator]in section: Compensation and Governance Response
“The proposal authorized distribution of 1,535,421.76 sdCRV (approximately $173,000 at the proposal date) to 242 affected addresses identified through on-chain state snapshots spanning Arbitrum, Ethereum mainnet, and Polygon at specific timestamps.”
reviewerSDGP-70 authorized distribution of 1,535,421.76 sdCRV to 242 affected addresses, identified via snapshots spanning Arbitrum, Ethereum mainnet, and Polygon.Same address-count discrepancy as the summary claim (294 vs 242 in the source document). The inclusion of Polygon among the affected-chain snapshot could not be corroborated from any source checked; all sourced reporting on this incident describes only Arbitrum and Ethereum mainnet. - #27[partially supported][awaiting moderator]in section: Systemic Risk Context
“Comparable incidents in the same period included exploits affecting Drift Protocol, Kelp DAO, and Wasabi Protocol.”
reviewerComparable incidents in the same period, attributed to private key compromise, included Drift Protocol, Kelp DAO, and Wasabi Protocol.All three incidents are real and occurred in the same window, and Drift/Wasabi do fit the 'private key compromise' framing of the surrounding paragraph, but reporting on Kelp DAO's root cause is split between key/session compromise and cross-chain message spoofing, so grouping it unqualified with the others overstates the uniformity of cause. - #28[partially supported][awaiting moderator]in section: Systemic Risk Context
“Industry analysts estimated DeFi losses across 2026 exceeded $770 million at the time of the StakeDAO incident.”
reviewerIndustry analysts estimated DeFi losses across 2026 exceeded $770 million at the time of the StakeDAO incident.The $770M figure is a genuine analyst figure from elsewhere, but the article actually cited in this section states $750 million, not $770 million — a mismatch between the page's citation and what that source says. Later trackers (CoinDesk/CryptoRank) put 2026 losses considerably higher by May, so pinning this number to 'the time of the StakeDAO incident' specifically is also imprecise. - #30[partially supported][awaiting moderator]in the timeline
“Stake DAO publishes detailed post-mortem and SDGP-70 governance proposal for voluntary ex gratia compensation of 1,535,421.76 sdCRV (~$173,000) to 242 affected addresses. Stake DAO also confirms it has filed a criminal complaint with Swiss authorities.”
reviewerStake DAO publishes detailed post-mortem and SDGP-70 proposal on June 9, 2026, compensating 242 affected addresses, and confirms filing a criminal complaint with Swiss authorities.Date, sdCRV amount, and criminal complaint are confirmed; the 242-address figure carries the same unresolved discrepancy against the source's own 294-address figure found elsewhere in the same proposal.
confirmed
17 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On May 27, 2026, a threat actor compromised a StakeDAO deployer private key that had retained owner privileges on the vsdCRV LayerZero v2 OFT contract on Arbitrum since March 2024, enabling the minting of 5.44 trillion unbacked vsdCRV tokens within 25 seconds.”
reviewerOn May 27, 2026, an attacker compromised a StakeDAO deployer private key that retained owner privileges on the vsdCRV LayerZero v2 OFT contract since March 2024, minting 5.44 trillion vsdCRV within 25 seconds.Independently corroborated by multiple contemporaneous outlets and the StakeDAO post-mortem summary. - #2[confirmed][no action needed]in the summary
“Despite the astronomically large nominal mint, thin DEX liquidity limited the attacker's realized gain to approximately 43.78 ETH (~$91,000), which was subsequently laundered via Tornado Cash.”
reviewerThin DEX liquidity limited the attacker's realized gain to ~43.78 ETH (~$91,000), later laundered via Tornado Cash.Confirmed across The Defiant, AMBCrypto and CryptoTimes. - #4[confirmed][no action needed]in section: Background: StakeDAO and vsdCRV
“At the time of the exploit, the protocol reported approximately $131 million in total value locked (TVL).”
reviewerAt the time of the exploit, StakeDAO reported approximately $131 million in TVL.Could not fetch either cited article directly (bot protection / 403), but independent search results cite $131M as the most commonly reported TVL figure, with one outlier source citing ~$151M. - #6[confirmed][no action needed]in section: Root Cause: Incomplete Ownership Handover
“The StakeDAO deployer wallet (address 0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62) had retained owner privileges on approximately 120 contracts across multiple chains since deployment in March 2024.”
reviewerThe StakeDAO deployer wallet (0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62) retained owner privileges on approximately 120 contracts across multiple chains since deployment in March 2024.Figure and address both confirmed; one source frames the 120 contracts as holding 'residual roles' rather than strictly 'owner privileges' on all of them, a minor characterization nuance. - #7[confirmed][no action needed]in section: Root Cause: Incomplete Ownership Handover
“StakeDAO's post-mortem described this as an 'incomplete ownership handover during deployment,' meaning the deployer EOA was never rotated out to the governance multisig for these contracts.”
reviewerStakeDAO's post-mortem described the root cause as an 'incomplete ownership handover during deployment.'Verbatim phrase confirmed in the cited post-mortem coverage. - #8[confirmed][no action needed]in section: Root Cause: Incomplete Ownership Handover
“Blockaid, PeckShield, and BlockSec independently confirmed that no smart contract vulnerability was involved; the attack was purely an operational compromise of the admin key.”
reviewerBlockaid, PeckShield, and BlockSec independently confirmed no smart contract vulnerability was involved; it was purely an operational key compromise.Confirmed; all three named firms appear across the sourced articles attributing the exploit to key compromise rather than a contract bug. - #9[confirmed][no action needed]in section: Attack Mechanism: LayerZero Peer Hijack and Forged Cross-Chain Mint
“The exploit minted exactly 5,446,744,073,709 vsdCRV tokens to the attacker wallet (0xeF3C054d8F7eD0a7D61c8da56ff55F090577aa25) on Arbitrum.”
reviewerThe attacker redirected trust from the legitimate Ethereum-side vsdCRVOFTAdapter to an attacker-controlled contract, then minted 5,446,744,073,709 vsdCRV to wallet 0xeF3C054d8F7eD0a7D61c8da56ff55F090577aa25 on Arbitrum in ~25 seconds.Both wallet addresses and the exact mint amount are corroborated verbatim across sources. - #11[confirmed][no action needed]in section: Financial Impact
“Despite the nominal minting of over 5.44 trillion vsdCRV tokens — nominally valued at approximately $763 billion at prevailing prices — the attacker's realized gain was drastically constrained by thin DEX liquidity.”
reviewerThe 5.44 trillion vsdCRV mint was nominally valued at approximately $763 billion at prevailing prices.Matches independently found analyst commentary on the nominal paper value of the mint. - #13[confirmed][no action needed]in section: Financial Impact
“On-chain, 321,143 CRV tokens and 7.5 ETH were drained from the Curve pool on Arbitrum.”
reviewerOn-chain, 321,143 CRV tokens and 7.5 ETH were drained from the Curve pool on Arbitrum.Confirmed verbatim in the cited post-mortem coverage. - #14[confirmed][no action needed]in section: Financial Impact
“Mainnet vsdCRV backing was secured by StakeDAO contributors within 47 minutes of the forged mint, before the attacker could bridge and extract backing collateral. The backing loss was reported as under 10,000 sdCRV.”
reviewerMainnet vsdCRV backing was secured within 47 minutes of the forged mint, and the backing loss was reported as under 10,000 sdCRV.Both figures confirmed verbatim in the cited post-mortem coverage. - #16[confirmed][no action needed]in section: Financial Impact
“A separate March 12, 2026 StakeDAO incident involving oracle message spoofing on Arbitrum and Base reportedly caused approximately $176,000 in losses, per one industry tracker, though that incident is distinct from the May 2026 deployer key exploit.”
reviewerA separate March 12, 2026 StakeDAO incident involving oracle message spoofing on Arbitrum and Base caused approximately $176,000 in losses, distinct from the May 2026 exploit.Date, chains, loss figure and distinctness from the May deployer-key exploit are all confirmed. - #17[confirmed][no action needed]in section: Immediate Incident Response
“On May 27, 2026, Blockaid was among the first firms to publicly detect and report the exploit in progress. PeckShield and BlockSec subsequently confirmed the attack vector and attributed the breach to the deployer key compromise.”
reviewerBlockaid was among the first to detect the exploit; PeckShield and BlockSec confirmed the vector; StakeDAO, Curve, and Beefy Finance issued warnings/precautions.Confirmed; also supported by independent search results noting Blockaid flagged the exploit first and BlockSec/PeckShield followed with attribution. - #20[confirmed][no action needed]in section: Immediate Incident Response
“The compromised deployer account's owner privileges were revoked and ownership was transferred to the governance multisig on the same day.”
reviewerThe compromised deployer account's owner privileges were revoked and ownership transferred to the governance multisig the same day as the exploit.Confirmed in the post-mortem coverage's own timeline. - #22[confirmed][no action needed]in section: Compensation and Governance Response
“Funding was sourced from 1,329,056.00 sdCRV recovered from the secured vsdCRV backing and 206,365.76 sdCRV from the Stake DAO treasury. Allocations below 100 sdCRV (~$10) were excluded for administrative efficiency.”
reviewerFunding for SDGP-70 compensation was 1,329,056.00 sdCRV from secured backing and 206,365.76 sdCRV from the treasury; allocations below 100 sdCRV were excluded; distributed via Merkle tree with a six-month claim window from early July 2026.Confirmed verbatim against the governance proposal. - #24[confirmed][no action needed]in section: Law Enforcement and Ongoing Investigation
“Stake DAO filed a criminal complaint with Swiss authorities and confirmed cooperation with law enforcement while preserving evidence.”
reviewerStake DAO filed a criminal complaint with Swiss authorities and confirmed cooperation with law enforcement while preserving evidence.Confirmed. - #26[confirmed][no action needed]in section: Law Enforcement and Ongoing Investigation
“The identity of the attacker had not been publicly disclosed as of the post-mortem.”
reviewerThe identity of the attacker had not been publicly disclosed as of the post-mortem.Consistent across all sources checked; none name the attacker. - #29[confirmed][no action needed]in section: Systemic Risk Context
“A separate StakeDAO incident in March 2026 involving oracle message spoofing — causing an alleged $176,000 loss on Arbitrum and Base — further underscores that the protocol experienced multiple security failures within the same calendar year, though the March incident involved a distinct vulnerability class.”
reviewerA separate StakeDAO March 2026 oracle message spoofing incident caused an alleged $176,000 loss on Arbitrum and Base, distinct from the May exploit.Consistent with the same source used earlier in the page for this incident.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.