Yearn Finance loses $9M in yETH exploit as attacker uses Tornado Cash

Blockchain records show that roughly $3 million in ETH was sent through the Tornado Cash mixer immediately after the attack.

yETH is an index token that aggregates popular liquid staking tokens. The pool was drained in a single transaction routed through a chain of newly deployed smart contracts, some of which were destroyed immediately after execution.

The attack was first flagged by an X researcher known as Togbe, who was tracking large fund movements. He said the exploit involved a “super mint” that let the attacker create yETH tokens far beyond protocol limits and exchange them for assets in the pool. He noted that some ETH was burned in the process, but the attacker still profited.

Yearn later confirmed total losses of $9 million. About $8 million came from the main stableswap pool and another $0.9 million from the yETH-WETH pool on Curve. The team said it is working with SEAL 911 and ChainSecurity as part of the investigation.

Yearn representatives noted that the V2 and V3 Vault products were not affected. They described the exploit as highly complex and comparable to the recent Balancer attack. The team added that no other Yearn product uses the codebase involved in the compromised pool.

Yearn has faced several incidents in the past. In 2021, the protocol lost $11 million in an attack on the yDAI vault, during which the hacker extracted $2.8 million. In 2023, an incorrect script wiped out 63% of one of Yearn’s treasury positions, though user funds were unharmed.

As of publication, Yearn has not provided further details on potential reimbursement or next steps. The incident remains under active investigation.