Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Stake DAO Private Key Leak: $91.00K Reported Loss

·Historical incident record

Incident Overview

On May 27, 2026, an attacker compromised StakeDAO’s deployer EOA private key and used it to repoint the vsdCRV LayerZero OFT peer on Arbitrum, forging a mint of ~5.44 trillion unbacked vsdCRV. The attacker drained ~43.8 ETH (~$91K) from the vasdCRV Curve pool before bridging the proceeds. StakeDAO core contracts were never at risk; legitimate backing was secured within 47 minutes, the product was deprecated, and a governance proposal was issued to fully compensate affected users.

Sources & References

Original incident referencehttps://x.com/stakedaohq/status/2064366142685094064?s=46&t=DLwbX9Nw4QECiyZQ0av-fg (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Stake DAO

    Attack methodSmart Contract Vulnerability
    Reported loss$ 176,000
  2. Incident date
    Attack methodMultisig Address Tampering
    Reported loss$ 15180000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 3,200,000
  4. Incident date
    Attack methodSybil Attack
    Reported loss$ 200,000
  5. Incident date
    Target

    ONTR

    Attack methodSmart Contract Vulnerability
    Reported loss$ 98,200