Yearn Finance Exploit Results in $9 Million Loss
- An attacker exploited a flaw in Yearn Finance’s legacy yETH product, minting nearly infinite yETH tokens.
- Approximately $9 million was lost, with $8 million from the main yETH stable-swap pool and $0.9 million from a yETH–WETH pool.
- The attacker transferred about 1,000 ETH (worth ~$3 million) to Tornado Cash to obscure the transaction trail.
- Yearn’s V2 and V3 vaults were not affected by this breach as it was isolated to an older implementation.
- Yearn Finance is collaborating with external security teams for a post-mortem analysis and vulnerability patching.
The exploit of Yearn Finance’s legacy product highlights vulnerabilities within custom swap codes when combined with liquid staking tokens. The incident caused significant financial loss but did not impact Yearn’s core products due to swift isolation measures.
By isolating the affected pool, Yearn Finance managed to protect its primary vaults from harm while initiating an investigation into the breach. This event underscores the importance of robust security measures in DeFi protocols to prevent similar incidents in the future.
