- The Stake DAO platform recorded a security incident on the Arbitrum network caused by an error in the vsdCRV vault contract logic.
- The attacker generated 5.4 trillion synthetic tokens, leading to the loss of $91,000 in assets from liquidity pools.
- The team secured the underlying assets on the Ethereum network, disabled the bridge, and closed the asdCRV Llamalend market.
On May 27, the decentralized finance protocol Stake DAO suffered from an exploit on the Arbitrum Layer 2 network. The attacker exploited a vulnerability in the smart contract associated with vsdCRV’s reward distribution and vault logic. An internal accounting failure allowed for the unauthorized issuance of 5.4 trillion pieces of synthetic tokens. Before stopping the operation, the perpetrator managed to withdraw cryptocurrency assets valued at approximately $91,000 from liquidity pools.
🚨 Blockaid detected an ongoing exploit targeting @StakeDAOHQ on Arbitrum. The attacker just minted over 5.4 trillion vsdCRV and is actively swapping it for ETH. More details in 🧵
How the error occurred in the Stake DAO protocol
Blockchain security firm Blockaid indicated in an analysis that the smart contract accepted an incorrect state transition. This directly enabled mass printing of vsdCRV tokens with no real backing.
The developers’ reaction was immediate. Core developers stopped the losses from spreading by blocking the transfer bridge for vsdCRV and securing guarantee funds that reside on the Ethereum mainnet. This action cut off the attacker’s ability to drain capital from the main protocol layer. The Ethereum ecosystem remained intact.
In the official announcement published on the X website, project representatives declared that the Liquid Lockers, Votemarket and loans mechanisms on the Morpho platform operate without disruptions.
However, the incident resulted in the decision to permanently withdraw the Arbitrum asdCRV Llamalend market. Protocol managers have issued a warning asking users to refrain from interacting with vulnerable vsdCRV contracts. Depositors using crvUSD were instructed to transfer their funds to other, safe markets within Llamalend.
Do you currently have cryptocurrencies?
It’s about cryptocurrencies on an exchange, in an application or in a wallet. Don’t treat cryptocurrency ETFs, ETNs and ETPs as ownership.
The survey is anonymous and voluntary. We do not collect your name or IP address. We only publish data in aggregate. Privacy Policy
DeFi security implications and industry debate
This statement forced Openzeppelin to issue a statement dissociating the company from the words of Aráoz, who left the organization’s structures in 2019. The audit company argues that modern tools based on artificial intelligence constitute an effective defense barrier if their implementation is supported by reliable verification by human experts. Additionally, Openzeppelin points out that most modern breaches result from errors in project management operating procedures, rather than flaws in the smart contracts themselves.
Investigative audit and legal actions taken by Stake DAO
The platform implemented crisis procedures and notified law enforcement authorities about the crime. The development team has worked closely with third-party auditing firms to monitor addresses associated with stolen cryptocurrencies. Cybersecurity specialists are currently conducting a detailed post-intrusion analysis of the source code to exclude the presence of similar vulnerabilities in other system modules.
The attacker’s transactions were identified on the blockchain, and the collected network logs will serve as evidence in the ongoing investigation proceedings.
