Decentralized finance protocol Yearn Finance has suffered a major security breach after attackers exploited a vulnerability in its yETH stableswap pool, leading to an estimated $9 million in losses.
The incident occurred on November 30 at approximately 21:11 UTC and involved a custom version of the stableswap contract code used exclusively for the yETH pool. Yearn emphasized that its widely used V2 and V3 vaults remain unaffected.
According to early indicators shared by Yearn, the attacker was able to mint a massive amount of yETH tokens, effectively “nearly infinite” quantities, in a single transaction. This allowed the exploiter to drain liquidity rapidly from the affected pool.
Initial assessments suggest losses of around $8 million from the yETH stableswap pool itself, with an additional $900,000 drained from the yETH–WETH pool on Curve Finance.
On-chain data shows the attacker quickly moved to launder part of the stolen assets. Roughly 1,000 ETH, valued at approximately $3 million, was funneled through Tornado Cash, making further tracking difficult.
Blockchain security analysts noted that the exploit relied on manipulating the minting logic of the custom contract rather than targeting core Yearn infrastructure.
Yearn confirmed the breach publicly, stating on X, “We are investigating an incident involving the yETH LST stableswap pool. Yearn Vaults (both V2 and V3) are not affected.” The team added that the impacted contract is separate from its flagship vault products and does not pose broader systemic risk to the protocol.
The yETH token aggregates multiple popular liquid staking tokens (LSTs), making it a key liquidity component in the protocol’s ecosystem. The sudden and nearly unlimited minting sharply deviated from normal behavior, allowing the attackers to drain the pool within minutes.
Yearn said it is conducting a full investigation and reiterated its commitment to security. The protocol highlighted its history of audits and robust vulnerability disclosure processes, noting that lessons from the incident will inform future safeguards.