Yearn Finance confirmed an active exploit targeting its yETH product on Nov. 30, after an attacker minted an effectively unlimited supply of tokens and drained liquidity from Balancer pools. The incident resulted in roughly $2.8 million in stolen assets. Approximately 1,000 ETH was laundered through Tornado Cash shortly after the attack, while YFI token prices unexpectedly spiked from near $4,080 to over $4,160 within an hour despite the negative news.
The exploit occurred around 9:11 p.m. UTC on Nov. 30, when a malicious wallet executed an infinite-mint attack that created roughly 235 trillion yETH in a single transaction, according to blockchain data.
Nansen’s alert system confirmed the attack.
The vulnerability existed in the yETH token contract itself, not in Yearn’s Vault infrastructure, and the attacker used the newly minted tokens to drain real assets — primarily ETH and Liquid Staking Tokens — from Balancer liquidity pools.
Early estimates suggest roughly $2.8 million in assets were removed. Several helper contracts used in the exploit were deployed minutes before the incident and self-destructed afterward to obscure the trail, while around 1,000 ETH was laundered through Tornado Cash shortly after the attack.
Yearn stated that V2 and V3 Vaults were not affected, and the vulnerability appears limited to the legacy yETH implementation.
Also Read: Strategy Would Sell Bitcoin Only as Last Resort if mNAV Drops Below 1x
The market reaction took an unexpected turn. Shortly after the exploit was flagged on social media and by blockchain analysts, YFI’s price climbed from near $4,080 to over $4,160 within an hour despite negative headlines surrounding the broader Yearn ecosystem.
The price spike appears tied to market misinterpretation in the early minutes of the incident, when initial claims of a “Yearn exploit” prompted high-leverage short positions on YFI given the token’s thin liquidity and historically aggressive downside moves during hack events.
Once it became clear the attack was isolated to yETH and not Yearn’s Vaults, short-sellers began covering their positions. This triggered a brief short squeeze and a volatility-driven price spike. YFI’s circulating supply is only 33,984 tokens, making it one of the most illiquid major DeFi governance assets, which amplifies price movements particularly during periods of uncertainty or rapid liquidation flow.
For now, losses appear contained to the yETH and Balancer pools touched by the exploit, while the protocol’s Total Value Locked remains above $600 million, suggesting core systems were not compromised. Investigations remain ongoing.
