Yearn Finance Recovers 2.39M After yETH Exploit

Decentralized finance protocol Yearn Finance announced on November 30, 2025, that it had recovered approximately 2.39 million in assets following an exploit that drained about 9 million from its yETH stableswap pool. The attack, which occurred around 2111 UTC that day, targeted a custom contract aggregating liquid-staked Ethereum derivatives, leaving the platform's core V2 and V3 vaults untouched.

The vulnerability allowed attackers to mint trillions of yETH tokens using just 16 wei of input, effectively inflating the token supply without adequate collateral. This enabled them to withdraw real assets, including Ethereum and staked tokens, from the yETH pool and an associated yETH-WETH pool on Curve Finance. Blockchain data showed losses of roughly 8 million from the primary pool and 900,000 from the Curve pool, totaling around 9 million. Approximately 1,000 ETH from the haul was routed through Tornado Cash, a privacy tool often used to obscure transaction trails, complicating recovery efforts. An additional 6 million in staked assets remained traceable in an attacker-controlled wallet as of initial scans.

Yearn Finance quickly confirmed the breach via social media, stating, "We...