Attackers exploited the StakeDAO deployer’s private key leak on May 27, minting approximately 54–54.5 trillion vsdCRV on Arbitrum, and only cashed out 43.781 ETH before bridging back to the Ethereum mainnet.

Put simply, someone got a “money-printing machine”: they wildly issued new derivatives tied to the Curve ecosystem within the Layer 2 protocol, but the value that could actually be cashed out ultimately came down to only a few dozen ETH. The contrast here isn’t about how exaggerated the loss amount is—it’s that once contract permissions are concentrated in a single private key, the so-called “decentralized logic” instantly breaks down.
This kind of incident brings the old problems back into focus again: key management and cross-chain security remain weak links in DeFi. For Arbitrum and CRV-related strategies, short-term risk appetite will most likely tighten; how the team explains this and whether it adjusts the permission architecture will directly affect how quickly trust can be restored afterward.