Yearn Finance yETH Exploit Drains Millions of ETH, 1,000 ETH Sent to Tornado Cash

COINOTAG News, citing The Block, reported that Yearn Finance suffered a security incident affecting its yETH product, a protocol that aggregates Liquid Staking Tokens. The affected pool, estimated near $11 million before the incident, has drawn industry scrutiny.

Investigators describe a crafted exploit minting an excessive amount of yETH in a single transaction, draining the pool. About 1,000 ETH (roughly $3 million) was routed to Tornado Cash, as new contracts self-destructed after the operation.

While losses remain under assessment, observers note the attack exploited new contracts and a minting vulnerability. The incident did not affect Yearn’s V2 and V3 Vaults, per official statements.

Past security events include a 2021 attack on the yDAI insurance vault with losses near $11 million and $2.8 million recovered by the attacker. In December 2023, a vault position saw a 63% drawdown, with funds unaffected.