DeFi platform Yearn Finance’s yETH product was hit with an unlimited token mint on Monday, draining the entire yETH pool in a single transaction.
Yearn later confirmed the “incident”, ensuring that its V2 and V3 vaults remain secure and unaffected.
According to blockchain data, the exploit generated a near infinite number of yETH, draining millions of balancer pools. The attackers profited from around 1,000 ETH, worth $3 million, which was routed through the Tornado Cash mixer, noted Chinese journalist Colin Wu.
yETH is an index token composed of several different versions of ETH, in other words, Ethereum Liquid Staking Derivatives (LST). The attack was first reported by X user Togbe, who highlighted “heavy transactions” on LSTs, including yearn, rocket pool, origin, and dinero.
The incident apparently involved several newly deployed smart contracts, which self-destructed after the transaction, according to blockchain data. The total financial losses remain unclear; However, the yETH pool had a total value of around $11 million before the attack, according to Dexscreener data.
Following this exploit, mixed reactions came from the community, with some expressing concern over the continued use of outdated contracts.
Additionally, Yearn Finance suffered a hack in 2021, affecting its yDAI vault and losing $11 million in value. The hacker apparently got away with $2.8 million at the time. Later, this protocol reported a faulty scenario in December 2023, wiping out 63% of a position in its treasury.
Meanwhile, blockchain security firm CertiK confirmed on Sunday that the crypto industry suffered an estimated $127 million in losses due to hacks and exploits.
The company’s monthly threat report indicated that the funds actually affected totaled more than $172 million. However, these figures decreased by $45 million after some of the stolen funds were recovered.
The Balancer DeFi protocol attack topped the list of major exploits in November, marking one of the biggest DeFi security breaches of 2025. The platform lost over $116 million in a sophisticated cross-chain exploit that affected multiple blockchains.
According to CertiK data, around $135 million was lost in DeFi incidents, followed by $29.8 million in exchange hacks.
Read original story yETH from Yearn Finance suffers major hack, attackers send $3M worth of ETH to Tornado Cash by Sujha Sundararajan on Cryptonews.com
