Decentralized finance protocol Yearn Finance confirmed on the 30th that its yETH-related liquidity pools were hacked, resulting in the theft of approximately USD 9 million worth of crypto assets.
? ALERT: Yearn Finance Loses $9M in yETH Pool Exploit Attack
Attacker minted infinite yETH tokens draining liquid staking pool in single transaction. About $3M worth of $ETH sent through Tornado Cash mixing service. Exploit involved freshly-deployed smart contracts that… pic.twitter.com/AYy8K1tsl7
— Unchained (@Unchained_pod) December 1, 2025
According to on-chain analysis, the attacker exploited a critical vulnerability in a legacy yETH contract, enabling them to mint an unlimited amount of yETH without posting any collateral. The attacker then drained liquidity from Balancer pools and later routed part of the stolen funds through the privacy mixer Tornado Cash, making recovery increasingly difficult.
How the Attack Happened
Blockchain security researchers identified that the exploit stemmed from a severe flaw in an old yETH contract still accessible within the protocol. The vulnerability allowed the attacker to mint yETH with no collateral, bypassing supply restrictions entirely.
Key findings include:
The attacker minted about 235 trillion yETH in a single transaction.
They used these tokens to drain liquidity from Balancer pools linked to Yearn.
Yearn Finance reported the total loss at around USD 9 million.
Before the attack, yETH pools held approximately USD 11 million, meaning the majority of assets were wiped out.
This exploit occurred on Ethereum (ETH), where Yearn’s smart contracts and vaults operate.
Stolen Funds Routed Through Tornado Cash
Of the funds extracted, 1,000 ETH—worth roughly USD 4.68 million—was sent to Tornado Cash, a privacy protocol often used to obscure transaction trails. The move significantly complicates efforts to trace or recover the stolen assets.
Security firm PeckShield estimates that the attacker’s wallet still holds around USD 6 million, suggesting additional movements may follow.
The incident highlights an ongoing concern in DeFi: legacy contracts and permissionless mixer tools remain prime vectors for large-scale hacks.
Yearn’s Response and User Guidance
Yearn Finance has urged users to stop interacting with yETH until further notice. The project emphasized that the exploit did not affect Yearn’s core products, including:
V2 Vaults
V3 Vaults
Yearn is now working with leading cybersecurity teams, including SEAL 911 and ChainSecurity, to investigate the exploit, patch vulnerabilities, and evaluate further protective measures.
Meanwhile, users are being reminded of the importance of rigorous wallet security: self-custody remains the final line of defense in the crypto ecosystem.
