Yearn Finance Suffers $9M Exploit as yETH Vault Hacked
Yearn Finance’s yETH vault lost approximately $9 million after attackers exploited a vulnerability to mint near-infinite yETH tokens, draining Balancer pools in a single transaction, according to a PeckShield report.
The Attack Unfolded in December
The exploit targeted a custom stETH/rETH liquidity pool on Balancer. Hackers leveraged a flaw in the yETH vault’s smart contract that permitted unlimited minting of yETH tokens. This inflated supply enabled the attackers to siphon assets valued at about $9 million, all within a single transaction.
PeckShield tracked the subsequent laundering of over $3 million in ETH through Tornado Cash, a privacy-focused mixer protocol designed to obscure transaction trails.
Technical Breakdown of the Breach
The vulnerability arose from the vault’s faulty token minting logic. Essentially, the smart contract failed to restrict minting operations, allowing attackers to produce yETH tokens without backing collateral. Pulling funds from the Balancer pools connected to this vault effectively translated those phantom tokens into real assets.
“The exploit involved manipulating the minting function in the yETH vault contract, which had no cap or verification preventing unlimited token creation,” PeckShield stated in their incident report.
Impact and Market Context
The $9 million theft adds pressure to the already weakened crypto market. Yearn Finance, despite its prominence, is grappling with the aftermath amid growing scrutiny over DeFi security. The broader DeFi lending market exceeds $25 billion, yet vulnerabilities like this continue to surface.
Read: $1,210 ETH price at press time (down 2.4% in 24h).
Yearn Finance Responds
Yearn Finance has acknowledged the breach, calling it an “incident” and confirming an ongoing investigation. The team has not yet disclosed plans for compensating affected users or patching the exploited vulnerability.
The full fallout depends on Yearn’s next moves and community governance responses.
What’s Next?
The investigation remains active. Users should exercise caution with yETH deposits until further updates. Anyone interacting with the stETH/rETH Balancer pool or the yETH vault should monitor official Yearn channels for security advisories.
This incident underscores persistent risks in complex smart contracts within DeFi protocols—even among top projects.
