5.4 trillion tokens for $90k, attackers worked all day and found the liquidity pool is even thinner than the wallet

According to Blockaid monitoring, StakeDAO was hacked on Arbitrum. The attacker has minted more than 5.4 trillion vsdCRV tokens and exchanged some of the tokens for $91,000 worth of ETH. It is suspected that the private key of the StakeDAO deployer was compromised; the attacker then used this to reconfigure the LayerZero v2 OFT peer in the vsdCRV token contract, shifting cross-chain trust from the legitimate Ethereum side adapter to a contract controlled by the attacker, thereby completing malicious cross-chain minting. StakeDAO has reminded users not to interact with vsdCRV. Multiple security monitors report that, due to limited liquidity, the attacker’s actual cash-out amount is approximately $91,000.