On May 27, 2026, an attacker compromised StakeDAO’s deployer EOA private key and used it to repoint the vsdCRV LayerZero OFT peer on Arbitrum, forging a mint of ~5.44 trillion unbacked vsdCRV. The attacker drained ~43.8 ETH (~$91K) from the vasdCRV Curve pool before bridging the proceeds. StakeDAO core contracts were never at risk; legitimate backing was secured within 47 minutes, the product was deprecated, and a governance proposal was issued to fully compensate affected users.