A security incident occurred on Arbitrum involving Stake DAO. Attackers allegedly obtained the protocol deployer's private key, modified the LayerZero v2 peer configuration of vsdCRV, and then forged cross-chain messages, triggering a large-scale aberrant minting.
Attack paths point to private keys and cross-chain configurations
According to the disclosure, the problem lies in the cross-chain communication settings of vsdCRV. After changing the peer address of LayerZero v2 to a controllable target, the attacker constructed a malicious cross-chain message, causing the contract to directly mint approximately 5.44 trillion vsdCRV into the wallet without any additional restrictions.
These attacks are not carried out through open market purchases, but rather by directly exploiting protocol permissions and cross-chain message verification processes to create a large supply of tokens that should not exist in the first place.
Some tokens have been exchanged and transferred to Ethereum.
Blockchain security firm Blockaid stated that the attackers have sold some of their tokens, obtaining approximately 43.78 ETH, and bridged the funds back to the Ethereum mainnet. This indicates that the assets have begun to be transferred across blockchains, potentially increasing the difficulty of tracking and freezing them.
- The attack occurred on the Arbitrum network.
- The token involved is vsdCRV of Stake DAO.
- Some funds have already been converted into approximately 43.78 ETH.
During the team's investigation, users were reminded to revoke authorization.
The Stake DAO team is still investigating the incident, with a focus likely on how the private key was leaked, when the configuration change occurred, and whether any other contracts or assets were affected.
During the investigation, users have been advised to revoke the relevant authorizations as soon as possible to mitigate subsequent risks. For DeFi protocols, once deployment permissions or cross-chain configurations are controlled, the impact often spreads rapidly from a single contract to fund transfers and liquidity.
