The attacker was seemingly able to mint infinite yETH through an exploit.
Yield-farming protocol Yearn Finance appears to have been targeted by an attack that drained millions of dollars worth of liquid staking tokens (LSTs) from its Yearn Ether (yETH) product, which aggregates popular LSTs into one token.
Blockchain data show the yETH pool was apparently drained through a carefully formed exploit that minted a near-infinite number of yETH tokens, draining the pool in a single transaction. As a result of the transaction, 1,000 ETH (worth about $3 million at current prices) was sent to mixing protocol Tornado Cash.
The attack seemingly involved several freshly-deployed smart contracts, some of which self-destructed following the transaction, blockchain data shows. The total scale of the financial loss is currently unclear.
The hack was first flagged by X user Togbe, who told The Block that they noticed the apparent attack while monitoring large transfers. “Net transfers suggest yETH super mint let the attacker drain the pool for some gain of 1k ETH,” Togbe said in a message. “Somehow other eth was sacrificed in this but they still [made] away with profit.”
“We are investigating an incident involving the yETH LST stableswap pool,” Yearn wrote on X. “Yearn Vaults (both V2 and V3) are not affected.”
Yearn Finance suffered an exploit in 2021 that affected its yDAI vault, which lost $11 million in value, with the hacker getting away with $2.8 million. In Dec. 2023, the protocol said a faulty script wiped out 63% of one of its treasury positions, but no user funds were affected. Andre Cronje, who founded Yearn in 2020, departed the project two years later.
The Block could not immediately reach Yearn for comment. This is a developing story.
