Stake DAO Hit by Active Exploit After Attacker Mints 5.44T vsdCRV on Arbitrum

Stake DAO suffered an active exploit on May 27 when an attacker minted 5.44 trillion vsdCRV on Arbitrum by compromising a deployer key and altering LayerZero peer settings, then swapped 43.78 ETH (~$91,000) to Ethereum. The breach follows a May 26 Uniswap phishing campaign that stole $400,000 via malicious Google ads, marking a two-day surge in DeFi attacks. Security firms including PeckShield and BlockSec attribute the exploit to the lack of multisig protections, allowing execution in roughly 25 seconds. Stake DAO has paused minting and revoked the compromised key while warning users not to interact with vsdCRV.