Attacker Mints 5.4 Trillion vsdCRV in Stake DAO Exploit

An attacker exploited Stake DAO's vsdCRV contract on Arbitrum, minting 5.4 trillion vsdCRV tokens and actively converting them to ether, according to security researchers reported by The Block.

Why It Matters

Unlimited token minting is one of the most damaging exploit vectors in DeFi — it allows an attacker to manufacture value from nothing and drain liquidity pools before governance or security teams can respond. As of July 2025, the attacker was still actively swapping fabricated vsdCRV for ether, meaning real ETH was leaving the protocol while researchers monitored on-chain. Any user holding vsdCRV or providing liquidity in related Stake DAO pools on Arbitrum faces direct exposure to dilution and potential total loss. This event also adds pressure on Curve ecosystem derivatives — vsdCRV is a vote-locked CRV derivative — at a time when the broader Curve ecosystem has already weathered multiple high-profile security incidents.

Context

Stake DAO is a DeFi yield and governance aggregator built on top of Curve Finance, allowing users to lock CRV tokens into liquid derivatives like vsdCRV to earn yield and voting power. Exploits targeting vote-locked token wrappers have become a recurring pattern; Curve itself suffered a $62 million reentrancy attack in July 2023, per The Block's prior coverage. Arbitrum's low transaction costs make it an efficient chain for attackers executing high-volume token swaps.

What's Next

Stake DAO's team needs to pause the affected contracts and publish a post-mortem detailing the exploit vector and any recovery plan for affected depositors. Users should monitor official Stake DAO channels and avoid interacting with vsdCRV contracts until a formal all-clear is issued. Gambling on protocol recovery timelines involves real financial risk.

---