Stake DAO Exploit Shows Why “Audited” Doesn’t Mean Safe In DeFi
The Stake DAO exploit on Wednesday compromised the protocol’s Arbitrum deployer key. An attacker minted roughly 5.4 trillion faux Vote-Boosted sdCRV (vsdCRV) tokens earlier than swapping them for ether by a public router.
The breach bypassed each smart-contract management in place. A single personal key with privileged rights has pushed tons of of hundreds of thousands in DeFi losses this yr.
How the Stake DAO exploit occurred
On-chain alerts from Blockaid traced the breach to a Stake DAO deployer pockets. The attacker used the important thing to reset the LayerZero v2 bridge peer for vsdCRV.
Roughly 25 seconds later, a solid cross-chain message minted 5.4 trillion vsdCRV on Arbitrum.
The attacker dumped the tokens for ether through MetaMask’s public router. No smart-contract flaw was discovered.
Notably, a recent LayerZero exploit on KelpDAO occured by related peer-configuration abuse.
A Familiar Pattern of Key Compromises
The Stake DAO exploit follows the identical template as April’s Wasabi Protocol drain. A compromised deployer pockets pulled round $4.5 million from vaults on 4 chains.
Drift Protocol misplaced $285 million on Solana that very same month. Arbitrum’s KelpDAO freeze adopted a $292 million bridge exploit weeks later.
Each protocol had handed audits. The failure sat above the code, within the keys that set bridge friends or improve implementations. Resolv’s $80 million mint earlier this yr match the identical mildew
“The query DeFi has to reply in 2026 is now not whether or not protocols get audited, as a result of nearly all of them do. It is whether or not the small set of operational keys behind these audited contracts… are nonetheless allowed to reside as a single object on a single laptop computer,” Sodot co-founder Shalev Keren informed BeInCrypto, including that audits now not reply the central query.
For Stake DAO and its friends, multisig wallet protections want to take a seat between deployer keys and solid mints. Otherwise, the subsequent DeFi platform compromise will hint again to a single laptop computer, not dangerous code.
The submit Stake DAO Exploit Shows Why “Audited” Doesn’t Mean Safe In DeFi appeared first on BeInCrypto.
