StakeDAO: Someone Minted 5.4 Trillion Tokens and Got $91K

At 09:17 on the morning of 27 May 2026, universal time, an account that had been sitting quietly on Arbitrum for more than two years changed one setting on one contract. Twenty-five seconds later that contract created 5,446,744,073,709 new tokens and handed them to a stranger. For a moment the stranger held, on paper, about $763 billion, more than the annual output of Switzerland.

They walked away with 43.8 ether, the currency of the Ethereum network, worth about $91,000.

The victim was StakeDAO, a crypto savings platform run by the Stake DAO Association, with, by different counts, $130 million to $150 million of customer money in it at the time. The gap between $763 billion and $91,000 is the strangest number in this year's run of hacks. The way the thief got in is the most ordinary.

What StakeDAO does

StakeDAO is a platform that takes deposits of crypto tokens and puts them to work for a yield, the way a fund manager pools savers' money and lends or invests it. Much of its business is built around Curve Finance, one of the oldest trading venues in decentralised finance (DeFi), the corner of crypto where code rather than banks runs lending and trading. Curve's own token, CRV, gives holders a say in how Curve pays out rewards, and that say is worth money.

StakeDAO lets people hand over their CRV in exchange for a receipt token called sdCRV, and then a further wrapper called vsdCRV that pools those votes and sells them for extra income. Think of vsdCRV as a share in a fund whose only asset is a pile of sdCRV. Every legitimate vsdCRV was backed one for one by sdCRV held on Ethereum. About 1.33 million sdCRV sat in that pile on the morning of the attack.

vsdCRV also lived on Arbitrum, a cheaper network that runs alongside Ethereum. To keep the two in step, StakeDAO used LayerZero, a messaging service that lets blockchains send each other instructions. When a holder moved vsdCRV from Ethereum to Arbitrum, the Ethereum side locked the tokens and sent a message, and the Arbitrum side created the same number. The Arbitrum contract trusted exactly one sender on Ethereum. Whoever owned the contract could change who that trusted sender was.

The key nobody handed over

That owner, it turned out, was not StakeDAO's governance group. It was a single account, the "deployer" that had launched the contract on 1 March 2024. StakeDAO's own disclosure, published on 9 June, said its process treated deployer keys as temporary: build the contract from one person's wallet, then hand control to a multi-signature wallet, a shared account that needs several people to approve each action, like a company cheque needing three signatures out of five. For the Arbitrum vsdCRV contract, that handover "was never completed". The deployer stayed in charge for about 27 months, with no co-signers and no delay on its changes.

Over two years the same account had picked up powers over roughly 120 contracts on seven blockchains, most of them abandoned. The contract was not on StakeDAO's monitoring list, so nothing raised an alarm when it was used.

At 09:17:33 the attacker, holding the deployer's private key, the password that controls an account, told the Arbitrum contract to trust a new sender: a contract the attacker had built. At 09:17:58 that fake sender delivered a message saying, in effect, "5.4 trillion vsdCRV have been locked on Ethereum, please create them here". The Arbitrum contract checked the message against its list of trusted senders, found a match, and did as it was told. StakeDAO stressed that this "was not a smart contract vulnerability". The code did what it was built to do. The wrong person was holding the keys.

Shalev Keren, co-founder of the key-security company Sodot, told Cointelegraph: "There is no smart contract bug here and no flaw in LayerZero." How the key was stolen is still under investigation, and StakeDAO has said it will not speculate.

Why $763 billion became $91,000

Printing tokens is easy. Selling them is not. The only real market for vsdCRV on Arbitrum was a small Curve pool, an automated trading pot where vsdCRV could be swapped for CRV and a related token. Pouring trillions of new tokens into it was like trying to sell every share of a large company through one corner shop: the price fell to almost nothing after the first few trades.

In about 20 minutes the attacker drained the pool's real assets, roughly 321,143 CRV and 7.5 ether, according to StakeDAO. The onchain analyst EmberCN counted about 16.83 million forged vsdCRV actually sold; the remaining trillions had no buyer. The attacker converted everything to ether, moved 43.776 ether to Ethereum through the Stargate bridge at 10:05, and on 31 May pushed 43.9 ether through Tornado Cash, a "mixer" that pools many users' coins so individual payments cannot be traced, in 16 deposits.

StakeDAO's team moved the 1.33 million sdCRV backing into a safe governance wallet 47 minutes after the forged mint. Before they got there, a few holders redeemed cheap vsdCRV against it, costing under 10,000 sdCRV.

The damage spread a little further. The poisoned pool also set the price of asdCRV, a related token used as collateral in a Curve lending market called LlamaLend. For 55 minutes that price collapsed, and some borrowers were automatically sold out of their loans, the way a broker closes a margin position when the shares backing it crash. Beefy Finance, which ran an automatic reinvesting vault built on the same pool, paused it.

Paying people back

StakeDAO cut its own losses quickly and then paid its users. In June its token holders approved a proposal, SDGP-70, to hand out 1,535,421.76 sdCRV, about $173,000 at the time, to the liquidity providers caught in the pool, including those in Beefy's vault. Most of it, 1,329,056 sdCRV, came from the backing the team had rescued; the remaining 206,366 came from the treasury. The vote closed on 19 June with no votes against, and claims opened in July. A second vote, SDGP-75, passed in early August and added 17,681 sdCRV for five LlamaLend borrowers who had been liquidated, after StakeDAO had first said the lending market suffered no loss.

The company filed a criminal complaint with Swiss prosecutors. As of 16 October 2026 no one has been identified or charged. StakeDAO's monthly report said assets on the platform fell 45% in May and fees fell another 43% in June.

The attack came eight days after Echo Protocol, where a stolen admin key minted $77 million of fake bitcoin tokens and the thief laundered about $822,000. It was not StakeDAO's only incident this year either: a March bug in its Votemarket rewards system cost about $175,000, and a second attack through the same flaw, which an earlier fix had failed to switch off on one network, took $5,871 in July.