Key Highlights
- Yearn’s yETH hack exploited a token bug, showing DeFi users face real risks from coding errors and vault mismanagement.
- Nearly $9M was lost as attackers minted near-infinite yETH, highlighting how small technical flaws can lead to massive DeFi losses.
- Governance and treasury decisions can amplify risks in DeFi, making careful oversight as crucial as technical security.
Decentralized finance (DeFi) protocol Yearn Finance was hit by a serious security breach after a hacker exploited its yETH pool, making off with around $9 million in Ethereum. The attack focused on yETH, Yearn’s token that bundles multiple popular liquid staking tokens (LSTs), and relied on minting an almost unlimited number of yETH tokens in just one transaction.
Onchain data reveal that attackers minted nearly infinite yETH, emptying the pool in a single transaction. Roughly 1,000 ETH, worth $3 million, was routed through Tornado Cash, obscuring the trail. Yearn confirmed on X, “We are investigating an incident involving the yETH LST stableswap pool. Yearn Vaults (both V2 and V3) are not affected.”
The incident came to public attention when observers first noticed unusual large transfers. X user Togbe stated, “Some other Balancer-related activity looks like an exploit, especially given heavy interactions with Tornado. Yearn, Rocket Pool, Origin, Dinero, and other LSTs are moving around.” Meanwhile, analyst Weilin (William) Li highlighted two key causes. “A rounding error led to minting near-infinite yETH,” he noted.
Li added that the attacker also exploited the “update_rate” function, burning yETH from st-yETH vaults and causing significant losses. Consequently, the hacker profited around $9 million, combining sold yETH and vault losses.
Mechanics behind the hack
The yETH exploit mirrors past DeFi vulnerabilities. Li explained, “The scaling factor, called rate, multiplies and divides numbers, breaking virtual balance invariants.” Essentially, the system miscalculated token balances, allowing near-unlimited minting.
The attacker combined precision timing with coding flaws for maximum gain and minimum visible activity. Only part of the minted yETH had been sold, thus keeping most of the profits off-chain, which created a very opaque flow of stolen funds.
Besides, the governance dynamics of Yearn have also been under question lately. Wintermute Trading tried to borrow 350 YFI tokens, worth $2.18 million. Their plan involved leveraging CRV tokens while supporting the development of yCRV markets. However, Yearn voters mostly rejected the loan, seeing little benefit for the protocol.
Yearn’s past vulnerabilities and wider DeFi risks
This is not the first operational setback for Yearn. In 2023, Yearn accidentally lost 63% of its treasury as a faulty automated script went haywire during a token swap.
Due to a lack of proper safeguards, the program could not limit the trade and thus resulted in huge price swings and unnecessary losses. Users who benefited from the slippage were asked to return reasonable amounts of the funds. Thankfully, no user funds were lost in that incident.
The broader DeFi sector continues to face significant security threats. CertiK reported that hacks and exploits led to $127 million in losses in November alone, with total affected funds surpassing $172 million before some were recovered.
The largest blow hit Balancer, which lost over $116 million in a sophisticated cross-chain attack. Incidents like Yearn’s yETH token rounding and calculation errors are keeping DeFi users on high alert.
Technical and governance risks exposed
The yETH hack has shown that DeFi platforms can contain serious technical weaknesses. People using yield-farming services need to understand that errors in smart contracts or mistakes made while managing vaults might come with big losses.
Disagreements over governance or how treasuries are handled can make these risks even higher. Yearn is still investigating, but the incident is a clear warning: profits in DeFi come with real technical and management risks.
Also Read: Kazakhstan’s Central Bank Plans Up to $300M in Crypto Investments
