Nexo Earn with Nexo
Stake DAO hacker nets $91K as illiquid pool blocks multi-billion dollar exit

Stake DAO hacker nets $91K as illiquid pool blocks multi-billion dollar exit

The attacker was unable to realize meaningful profits due to vsdCRV's extremely thin liquidity.

Share

Add us on Google
By Editorial Team
Edited by Vivian

Stake DAO, a non-custodial liquid staking platform, became the target of a major exploit on Arbitrum after hackers allegedly compromised the protocol’s deployer private key, enabling the minting of more than 5.4 trillion vsdCRV tokens through a manipulated cross-chain messaging infrastructure, according to security firm Blockaid.

Investigators said the attacker took control of the Stake DAO deployer address and altered the LayerZero v2 OFT peer configuration linked to the vsdCRV token contract.

By redirecting trust from the legitimate Ethereum-side adapter to an attacker-controlled malicious contract, the hacker was able to send a forged cross-chain message that generated roughly 5.4 trillion new vsdCRV tokens, Blockaid explained.

Despite the exploit generating a nominal value estimated at $763 billion, the attacker struggled to convert the tokens into actual cash because of severely limited liquidity in vsdCRV markets.

On-chain analyst EmberCN reported that only 16.83 million tokens were exchanged for about 43.7 ETH, or roughly $91,000, before DEX liquidity dried up.

Stake DAO said that they were aware of the situation and warned users not to interact with vsdCRV.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
DEFI

Stake DAO hacker nets $91K as illiquid pool blocks multi-billion dollar exit

Stake DAO hacker nets $91K as illiquid pool blocks multi-billion dollar exit

The attacker was unable to realize meaningful profits due to vsdCRV's extremely thin liquidity.

By Editorial Team
Edited by Vivian

Share

Add us on Google

Stake DAO, a non-custodial liquid staking platform, became the target of a major exploit on Arbitrum after hackers allegedly compromised the protocol’s deployer private key, enabling the minting of more than 5.4 trillion vsdCRV tokens through a manipulated cross-chain messaging infrastructure, according to security firm Blockaid.

Investigators said the attacker took control of the Stake DAO deployer address and altered the LayerZero v2 OFT peer configuration linked to the vsdCRV token contract.

By redirecting trust from the legitimate Ethereum-side adapter to an attacker-controlled malicious contract, the hacker was able to send a forged cross-chain message that generated roughly 5.4 trillion new vsdCRV tokens, Blockaid explained.

Despite the exploit generating a nominal value estimated at $763 billion, the attacker struggled to convert the tokens into actual cash because of severely limited liquidity in vsdCRV markets.

On-chain analyst EmberCN reported that only 16.83 million tokens were exchanged for about 43.7 ETH, or roughly $91,000, before DEX liquidity dried up.

Stake DAO said that they were aware of the situation and warned users not to interact with vsdCRV.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.