Yearn Finance’s yETH Faces Significant Hack, $3M in ETH Laundered via Tornado Cash

Yearn Finance’s yETH product experienced a significant hack involving unlimited token minting, draining the entire yETH pool in a single transaction. While attackers made away with approximately $3 million, Yearn Finance assured users that its V2 and V3 Vaults remain secure. The incident underscores ongoing security concerns in the DeFi space.

Key Takeaways

Yearn Finance’s yETH was compromised, resulting in the loss of around $3 million.
The attack involved unlimited minting of yETH tokens through newly deployed smart contracts.
This incident brings attention to the security vulnerabilities present in decentralized finance (DeFi).
In November alone, the cryptocurrency sector faced losses estimated at $127 million due to hacks and scams.

yETH hack

Major Attack on Yearn Finance’s yETH Product

On Monday, Yearn Finance’s yETH product was targeted in a significant attack involving an unlimited minting of tokens, which led to the entire yETH pool being drained in a single transaction. Yearn Finance later confirmed the incident, assuring users that its V2 and V3 Vaults remain secure and have not been affected.

Blockchain data reveals that the exploit enabled the creation of a near-infinite amount of yETH, withdrawing millions from Balancer pools. The attackers gained approximately 1,000 ETH, valued at about $3 million, which they then funneled through the Tornado Cash mixer, as noted by Chinese journalist Colin Wu.

The yETH token serves as an index for various liquid staked versions of ETH, also termed Ethereum Liquid Staking Derivatives (LSTs). The attack was first brought to attention by an X user, Togbe, who highlighted unusual transaction activity on LSTs including Yearn, Rocket Pool, Origin, and Dinero.

Examining DeFi Security After the yETH Incident

The attack seems to have involved several newly deployed smart contracts, which self-destructed following the transaction, according to blockchain data. While the exact financial damage remains unclear, Dexscreener data suggests that the yETH pool held a total value of around $11 million before the hack.

In the aftermath of the exploit, community reactions varied, with some expressing concern over the use of outdated contracts. It's important to note that Yearn Finance had previously suffered a hack in 2021, impacting its yDAI vault and resulting in an $11 million loss, with the hacker taking away about $2.8 million at that time. In December 2023, a faulty script flagged by the protocol wiped out 63% of a position in its treasury.

Extensive Losses in the Crypto Space

Additionally, blockchain security firm CertiK confirmed that the cryptocurrency industry incurred an estimated $127 million in losses due to hacks and exploits in November alone. Their monthly threat report indicated that the total affected funds exceeded $172 million, although this number dropped by $45 million as some stolen assets were recovered.

The Balancer DeFi protocol hack stands out as the most significant exploit for November, representing one of the largest security breaches in DeFi for 2025. This incident resulted in losses exceeding $116 million from a complex cross-chain exploit impacting multiple blockchains. Overall, around $135 million was lost in DeFi incidents, followed by $29.8 million from exchange hacks, according to CertiK's findings.