Yearn Finance’s YETH Token Goes Rogue, Loses $3M to Tornado Cash 🤯

by

Oh, the universe. It’s a pretty big place. And apparently, it’s also a pretty bad place for Yearn Finance, which has just been hit by an exploit so cheeky, it’s probably checking its own bank account right now. 🤯💥

Yearn Finance is dealing with a fresh security breach after an attacker exploited its yETH token contract and drained millions in ETH and liquid staking assets from Balancer pools. The kind of breach that makes you wonder if the blockchain was just a really bad idea. 🧠

  • The exploit targeted an older yETH contract, which, if it had a personality, would probably be the kind of person who leaves the fridge door open and then blames the milk. 🥛
  • Around 1,000 ETH moved through Tornado Cash shortly after the attack, with more assets still held across the attacker’s wallets. Tornado Cash, ever the enigmatic figure, has once again proven that if you want to disappear, you don’t just need a plan – you need a blockchain. 🕵️‍♂️
  • Yearn confirmed the issue is isolated from its V2 and V3 Vaults and is preparing a detailed report on the incident. Because nothing says “we’re totally not worried” like a tweet that’s 90% emojis and 10% actual information. 🤡

The incident unfolded late on Nov. 30 when an attacker triggered an infinite-mint flaw inside the yETH contract. They then minted an impossibly large supply of yETH, more than 235 trillion tokens, in a single transaction. If you thought your bank account was full, you were wrong. This was a different kind of full. 💸

With those tokens, the attacker moved quickly through Balancer pools, removing real assets, including ETH and popular staking derivatives. Initial traces show close to $3 million flowing through Tornado Cash shortly after the exploit, while the attacker’s address still holds additional assets tied to the event. Tornado Cash, ever the enigmatic figure, has once again proven that if you want to disappear, you don’t just need a plan – you need a blockchain. 🕵️‍♂️

Exploit isolated to legacy yETH product

Blockchain data shows the yETH stableswap pool was emptied within minutes, leaving a roughly $2.8 million hole. Yearn Finance(YFI) said the issue sits within an older implementation of yETH and does not touch its V2 or V3 Vaults. Protocols built on Yearn V3, including Katana, also reported no exposure. It’s like the old yETH was the weird cousin who brought a knife to a party, and everyone else is just glad they didn’t get involved. 🤷‍♂️

We are investigating an incident involving the yETH LST stableswap pool.

Yearn Vaults (both V2 and V3) are not affected.

– yearn (@yearnfi) November 30, 2025

Several helper contracts appeared just moments before the attack and vanished through self-destruct calls once the pool was drained, making the trail harder to follow. It’s like they were ghosts, but even the ghosts had a plan. 👻

Security teams reviewing the transactions, including auditors tracking Yearn’s older products, linked the event to a long-standing minting weakness inside the yETH token logic, rather than a problem in Yearn’s current vault architecture. Because nothing says “we’re secure” like a 10-year-old bug that’s still causing chaos. 🧨

The protocol maintains a live bug bounty program with rewards reaching $200,000 for critical discoveries, though no recovery path has been announced yet. Because nothing says “we’re serious about security” like offering a reward that’s less than the amount lost. 💸

On-chain movement intensifies after liquidity drain

Soon after the pool collapsed, X user Togbo flagged several movements of 100 ETH batches passing through Tornado Cash. Around 1,000 ETH in total was mixed in the hours following the exploit. The attacker still retains additional assets worth several million dollars across multiple wallets. It’s like the attacker is playing a game of “how many times can you hide a million dollars before someone notices?” and the answer is “quite a lot.” 🎯

some other balancer related stuff looking like an exploit considering heavy interactions with tornado

yearn, rocket pool, origin, dinero and other LST going around

– Togbe (@Togbe0x) November 30, 2025

The yETH pool carried roughly $11 million before the breach, and while the final loss number is still under review, Yearn said user funds inside active vaults remain safe. Because nothing says “we’re trustworthy” like a protocol that’s lost $3 million but still claims everything’s fine. 🤝

This incident adds to the protocol’s long record of managing legacy risks, coming years after its 2021 yDAI exploit and a 2023 treasury misconfiguration that did not affect depositors. YFI slipped about 4% after the event and traded near $4,002 at press time. So, in conclusion, Yearn Finance is basically the financial equivalent of a house with a leaky roof – it’s not the end of the world, but you definitely don’t want to be the one paying for the repairs. 🏡

Read More

2025-12-01 06:31