Major Exploit Drains Millions from yETH Pool

A sophisticated attack on the liquidity pool of yETH — the liquid staking token index offered by Yearn Finance — drained millions of dollars in assets when an attacker minted an effectively unlimited amount of yETH and exchanged the bogus tokens for real ETH and other liquid-staking assets. Blockchain data indicate close to 1,000 ETH — roughly US$ 3 million — was swiftly moved through mixing service Tornado Cash in a single transaction, while the wider financial impact may scale significantly higher.

The exploit hinged on a critical flaw in the smart contract underpinning yETH’s “stableswap pool,” which permitted the creation of an unbounded number of yETH tokens. Immediately after minting, the attacker used those tokens to withdraw real ETH and other assets from liquidity pools tied to yETH, rapidly draining the pool. Multiple helper contracts deployed for the attack self-destructed soon after, making tracing efforts challenging.

Shortly after the event, Yearn Finance confirmed the breach and clarified that its core vault offerings — including V2 and V3 vaults — remain unaffected, noting the issue appears isolated to the legacy yETH pool. That distinction may have prevented a broader protocol-wide collapse, although internal assessments are ongoing to fully understand the exploit’s scope.

Further on-chain analysis by security firms suggests total losses could approach US$ 9 million, once damage to auxiliary pools — including a yETH–WETH pool — are accounted for. Nearly US$ 3 million in stolen ETH has already been funneled through Tornado Cash, rendering recovery difficult as funds are mixed and dispersed.

Market reaction was immediate: major cryptocurrencies including Bitcoin and Ether slid sharply during Asian trading hours, signalling heightened investor anxiety about DeFi security vulnerabilities. The incident has reignited scrutiny over legacy smart-contract code within decentralised finance platforms and underscored persistent risks associated with innovation outpacing security audits.