One of the leading decentralized finance (DeFi) protocols, Yearn Finance, suffered an exploit targeting its yETH stableswap pool, resulting in a $9 million loss. X user Togbe first noticed the attack when they saw heavy on-chain interactions with Tornado Cash.
Yearn Finance’s yETH pool exploited
In an X announcement earlier today, yield-farming DeFi project Yearn Finance confirmed the attack. The protocol noted that during the night of November 30, an “incident occurred” involving the yETH pool, resulting in the minting of a large amount of yETH tokens.
For the uninitiated, yETH – short for Yearn Ether – is an index token that represents a collection of various Liquid Staking Tokens (LSTs). Yearn Finance’s yETH stableswap pool was drained of $8 million, while another $0.9 million was pulled from the yETH-WETH pool on Curve Finance.
Following the exploit of the yETH pool on Yearn Finance, about 1,000 ETH, valued at approximately $2.85 million according to current market prices, was sent to cryptocurrency mixer Tornado Cash.
The orchestrators of the attack used complex, sophisticated techniques, including deploying self-destructing smart contracts to execute the theft. According to data from Dexscreener, the total value of assets in the yETH pool was close to $11 million before the exploit.
However, it is worth emphasizing that besides the yETH pool, no other product of Yearn Finance was impacted. The protocol assured its users that there is no risk to the Yearn V2 and V3 vaults.
In their initial analysis, the team at Yearn Finance remarked that the nature of the exploit was similar in complexity to that observed last week pertaining to the Balancer DeFi protocol. At the time, the smart contract assault led to an initial estimated loss of $128 million.
Close to no impact on token price
Despite the exploit targeting the yETH pool, the impact on Yearn Finance’s Total Value Locked (TVL) and token value appears minimal. According to data from DefiLlama, Yearn Finance’s total asset value currently stands slightly above $410 million.
Meanwhile, the protocol’s native token, YFI, is down 6.2% over the past 24 hours. The Yearn Finance team is currently performing post-mortem analysis on the hack with its audit partner ChainSecurity and is expected to release new information as it becomes available.
