DeFi platform Yearn Finance’s yETH product was hit by an unlimited minting of tokens on Monday, draining the entire yETH pool in a single transaction.
Yearn later confirmed the “incident”, assuring that its V2 and V3 Vaults remain secure and unaffected.
According to blockchain data, the exploit generated a near-infinite number of yETH, draining millions from Balancer pools. Attackers roughly profited 1,000 ETH, worth $3 million, which was routed through the Tornado Cash mixer, Chinese journalist Colin Wu noted.
yETH is an index token consisting of several different liquid staked versions of ETH, in other terms, Ethereum Liquid Staking Derivatives (LSTs). The attack was first flagged by an X user Togbe, who highlighted “heavy transactions” on LSTs, including yearn, rocket pool, origin and dinero.
The incident apparently involved several newly deployed smart contracts, which self-destructed after the transaction, per blockchain data. The total financial losses remain unclear; however, the yETH pool had a total value around $11 million prior to the attack, Dexscreener data shows.
Following the exploit, mixed reactions came from the community, with some expressing concern over the continued use of outdated contracts.
Besides, Yearn Finance suffered a hack in 2021, affecting its yDAI vault and losing $11 million in value. The hacker apparently got away with $2.8 million at that time. Later, that protocol flagged a faulty script in December 2023, wiping out 63% of a position in its treasury.
Meanwhile, blockchain security firm CertiK confirmed on Sunday that the crypto industry suffered an estimated $127 million in losses to hacks and exploits.
The company’s monthly threat report noted that the actual affected funds were more than $172 million. However, the numbers reduced by $45 million after some of the stolen funds were recovered.
Balancer DeFi protocol attack tops the list of major exploits in November, marking one of 2025’s largest DeFi security breaches. The platform lost over $116 million in a sophisticated cross-chain exploit that affected multiple blockchains.
About $135 million was lost in DeFi incidents, followed by $29.8 million drained in exchange hacks, CertiK data noted.
