Yearn Finance Exploit Drains 9 Million from yETH Pool

Yearn Finance, a prominent decentralized finance protocol, suffered a significant exploit on November 30, 2025, when attackers drained approximately 9 million from its yETH stableswap pool through a vulnerability in the custom smart contract code. The incident, which occurred around 2111 UTC, targeted the yETH token, an index combining multiple liquid-staked Ethereum derivatives, but left the platform's core V2 and V3 vaults unaffected.

Blockchain data shows that the attackers exploited a flaw allowing them to mint trillions of yETH tokens using just 16 wei of input, effectively inflating the token supply without adequate collateral. This enabled them to withdraw real assets, primarily Ethereum and liquid staking tokens, from the yETH pool and an associated yETH-WETH pool on Curve Finance. Losses totaled about 8 million from the yETH pool itself and 900,000 from the Curve pool, according to Yearn's assessment. The hackers deployed temporary smart contracts minutes before the attack, which self-destructed afterward to complicate tracing. Roughly 1,000 ETH, valued at around 3 million, was subsequently laundered through Tornado Cash, a cryptocurrency mixer often used to obscure...