Yearn Finance yETH Exploit: Millions Drained, $3M Laundered
2.2 Security Yearn Finance's yETH product was exploited, allowing an attacker to mint excessive tokens and drain millions in assets. About $3 million in ETH was sent to Tornado Cash. V2 and V3 Vaults were unaffected.
Yearn Finance experienced a significant exploit targeting its yETH product, which aggregates liquid staking tokens. The attacker exploited a vulnerability in the yETH token contract, enabling the minting of an excessive number of tokens in a single transaction. This allowed the draining of millions of dollars in assets, primarily from Balancer liquidity pools, with estimates of losses ranging from $3 million to $15 million. Approximately 1,000 ETH, valued at around $3 million, was sent to Tornado Cash following the attack. The exploit involved freshly deployed smart contracts, some of which self-destructed after the incident to obscure the trail. Yearn Finance confirmed that its V2 and V3 Vaults were not affected, and the vulnerability was limited to legacy yETH contracts. The protocol is investigating the breach and emphasizes the importance of ongoing audits and deprecating outdated contracts to enhance DeFi security. Community reactions highlighted concerns over the use of outdated contracts, but the security of current vaults helped mitigate panic.
