Yearn Finance faced renewed scrutiny after attackers drained its yETH pool through an unlimited minting exploit.
The incident disrupted one of DeFi’s key index-style products and revived questions about outdated smart contracts.
The entire yETH pool disappeared in a single transaction, alarming users across the liquid staking sector.
Attackers mint unlimited yETH and drain millions
Yearn Finance confirmed the exploit on Monday and said its V2 and V3 Vaults remained secure and unaffected.
Blockchain data showed attackers generated a near-infinite supply of yETH, then emptied Balancer pools tied to the token.
Reports indicated the attackers gained about 1,000 ETH, worth roughly $3 million, and routed the funds through Tornado Cash.
Chinese journalist Colin Wu shared those details while noting the speed of the outflow.
yETH serves as an index token made up of multiple liquid-staked ETH assets, known as Ethereum Liquid Staking Derivatives.
The issue surfaced when X user Togbe flagged heavy activity across Yearn, Rocket Pool, Origin, and Dinero.
Analysts later linked the exploit to newly deployed contracts that executed the attack and self-destructed immediately.
Dexscreener data showed the yETH pool held about $11 million before the breach.
Community members criticized the continued reliance on older contracts and referenced Yearn’s past incidents.
The platform suffered a 2021 yDAI vault hack that erased $11 million in value, with the attacker keeping $2.8 million.
Another issue emerged in December 2023, when a faulty script removed 63% of a treasury position.
Broader industry losses highlight security gaps
Blockchain security firm CertiK estimated that the crypto sector lost about $127 million to hacks and exploits in November.
Total affected funds surpassed $172 million before partial recoveries lowered the figure by $45 million.
CertiK identified the Balancer exploit as the largest attack of the month, noting that it resulted in losses of more than $116 million across multiple blockchains.
The firm added that DeFi incidents accounted for about $135 million in losses, while exchange hacks drained roughly $29.8 million.
Analysts said attackers continued to exploit contract vulnerabilities at a faster pace, stressing the need for stronger protections.
As investigations continue, users await updates on accountability and possible recovery linked to the yETH collapse.