yearn.finance (YFI)

$9M Yearn Finance Exploit ( Nov 30, 2025) An attacker exploited an infinite mint vulnerability in Yearn’s yETH StableSwap pool, minting ~235T yETH and draining $9M in one transaction. Funds Flow: 🔹 1,000 $ETH ($3M) sent to Tornado Cash 🔹 ~$6M remains in exploiter wallet (0xa80d…c822) in staked ETH derivatives (pxETH, frxETH, stETH, rETH) 🔹 $2.4M pxETH recovered with Plume & Dinero Impact: 🔹 YFI dropped 17% After Hacked 🔹 Core Yearn vaults with $410M+ deposits remain safe 🔹 2025 DeFi hacks now total $2.5B+ Infinite Mint flaws are real, and even top DeFi pools are vulnerable. Time to audit, patch, and rethink pool security. @yearnfi #YFI

Should we rebuild the Open Zeppelin address & ownership libraries to use this kind of hashing?

Yearn claws back $2.4M from $9M yETH infinite mint rug, postmortem blames unchecked math, Tornado Cash launder. DeFi 'resilience'? Rapid response on legacy exploits. Bitcoin: 16 years, zero rugs, just code that works. Complexity kills; simplicity wins.

📊 Yearn Finance announced the recovery of $2.4 million from the #yETH exploit that stole $9 million after exploiting a precise mathematical flaw in the smart contract. Collaboration with #Plume and #Dinero enabled funds to be returned to users without court intervention. "The investigation continues to prevent future incidents". The recovery effect strengthens confidence in #YFI and supports platform stability. #YearnFinance #DeFi #Ethereum #YFI #CryptoSecurity

🚨 Yearn Finance recovers $2.4 million from the hacker The Yearn Finance team recorded the first victory in the asset recovery battle after yesterday's attack. To date, the project has reclaimed $2.4 million of stolen assets out of an estimated total loss of nearly $9 million. However, the "rescue" operation still faces many challenges. The report confirms that the attacker promptly moved at least 1,000 ETH and some liquid staking tokens into the anonymous mixer Tornado Cash, making it difficult to trace and recover the remaining assets. The incident originated from a calculation vulnerability that opened a loophole for the hacker to mint an almost unlimited amount of yETH to drain liquidity from the yETH stableswap pool and the yETH‑WETH pool on Curve. This is the third security incident targeting Yearn since 2021, with sophistication comparable to the recent Balancer hack (https://t.co/o3tdxpvgqj).

⚠️ATTENTION⚠️ YEARN FINANCE WAS HACKED 💥The attack was sophisticated and drained MILLIONS in a few minutes, including a $yETH depeg 👀It did not affect the main vaults, but the impact hit the entire #DeFi ecosystem WHAT HAPPENED WITH THE YEARN HACK⁉️ 🔸On November 30, 2025, a hacker exploited a vulnerability in the old yETH contract, a token that aggregates Ethereum staking 🔸The flaw was in the MINTING logic: it allowed issuing up to 235 trillion yETH without real backing 🔸He used those fake tokens to steal real ETH and liquid staking from a pool on Balancer, emptying it completely -The attacker prepared everything over 28 days -Deployed contracts that self‑destructed after the attack -In minutes, the pool lost $11M, of which $3M in ETH was laundered via Tornado Cash WHAT WAS THE IMPACT⁉️ 🔹Estimated total losses: $9 million 🔹The YFI token fell 5-6% to $3,900 🔹Yearsp's TVL dropped from $432M to $410M 🔹There was a $yETH depeg IS YEARN FINANCE AT RISK⁉️ 🛡NO. The protocol confirmed that: ▪️Only the yETH pool was affected ▪️Vaults V2 and V3 are 100% safe ▪️Other products like yUSD were not impacted ▪️User funds in active vaults are protected 📍Compensations have not been announced yet, but in previous hacks Yearn used its treasury to cover losses...