Yearn Finance has experienced a significant security breach, with hackers draining approximately $9 million from its yETH vault. According to the blockchain security firm PeckShield, the exploit enabled hackers to mint an unlimited supply of yETH tokens, resulting in substantial losses.

Exploit Details

The attack specifically targeted a legacy pool related to the yETH token, allowing the exploitation of vulnerabilities in the contract. PeckShield reported on the incident via X, stating, “Yearn Finance suffered an attack resulting in a total loss of ~$9M.”

The breach exploited a loophole in the yETH contract that permitted the minting of tokens without sufficient collateral, which led to the draining of liquidity from an external pool that dealt with staked Ethereum derivatives, namely stETH and rETH.

Following the attack, the stolen assets were laundered through Tornado Cash, with approximately $3 million in ETH moved, while $6 million in staked assets remain in the attackers’ wallet address (0xa80d…c822). Yearn Finance confirmed the breach on their official X account, reporting that $0.9 million was lost from the yETH-WETH stable swap pool, and affected users were urged to reach out via Discord for support.

Investigation Underway

In response to the attack, Yearn Finance has convened a war room, collaborating with SEAL911 and Chain Security to conduct a thorough investigation and analysis

Related Incidents

This hack resembles the recent Balancer breach, which resulted in the theft of over $120 million. Blockchain investigators have noted that this incident shares similar technical complexities.

In addition, the Yearn incident follows closely on the heels of a breach at the Korean exchange Upbit, which saw losses of $50 million in Ethereum.