The Yearn Finance attack caused initial damage of about 3 million USD.

Yearn Finance has been attacked by a new vulnerability targeting its yETH product, a synthetic token representing a basket of LSTs like stETH and rETH. The attacker managed to create nearly unlimited yETH and drained liquidity in a single transaction, extracting around 1,000 ETH worth approximately 3 million USD. Part of the stolen funds was transferred through Tornado Cash to obscure the trail.
On-chain data shows that the attacker deployed several new smart contracts specifically for the attack, then executed self-destruct functions immediately after the transaction. The exact total damage is still being assessed. Before the attack, the yETH pool had about 11 million USD in TVL.
Yearn has stated that this incident is limited to yETH and confirmed that Yearn Vaults (V2 and V3) remain unaffected. The selected Morpho vaults are also safe. The yETH and st-yETH tokens are not used as collateral in any lending markets, limiting the risk of contagion.
This is not the first time Yearn has encountered security issues. Back in 2021, the yDAI vault was exploited for 11 million USD. Founder Andre Cronje has not been active in the project since 2022.
$BTC