Stake DAO’s Votemarket module was exploited. The attacker used a vulnerability in the L1BlockOracleUpdater peripheral contract to inject fabricated L1 block data via the LaPoste cross-chain bridge, poisoning the oracle and forging vote proofs to drain ~$176,000 in campaign incentive rewards across 54 campaigns. The incident was later resolved as a white-hat event with most funds recovered.