Stake DAO is facing an ongoing exploit involving its vsdCRV token on Arbitrum, with security firms reporting that an attacker minted more than 5.4 trillion tokens and swapped some of them for 43.78 ETH, worth about $91,000, before bridging funds to Ethereum. According to BlockSec, the suspected root cause is a compromised Stake DAO deployer private key that was used to set an arbitrary peer for vsdCRV and forge a malicious cross-chain message, triggering unconditional minting of about 5.44 trillion vsdCRV to the attacker’s address. Stake DAO said it is aware of the incident and urged users not to interact with vsdCRV. The Block also cited Sodot co-founder Shalev Keren, who said the exploit was structurally similar to other deployer-key compromises and involved changing the vsdCRV cross-chain bridge configuration on Arbitrum to an attacker-controlled contract on Ethereum before a LayerZero message triggered the mint.