DeFi protocol Yearn Finance has become the latest victim of a sophisticated exploit that led to a loss of approximately $9 million. According to blockchain security firm PeckShield, the exploit was tied to the platform’s yETH token, which was manipulated to mint near-infinite tokens, allowing the attacker to drain significant funds.
The attacker capitalized on a vulnerability in Yearn’s yETH vault, allowing them to mint excessive tokens far beyond the actual value of the assets deposited. This tactic enabled the draining of funds from the protocol’s pool with minimal input.
Funds Laundered and Remaining Traceable
Soon after the exploit, 1,000 ETH (roughly $3 million) was funneled through TornadoCash, a privacy tool frequently used to obfuscate crypto transactions. The goal was likely to hide the attacker’s tracks and make recovery efforts more difficult.
Despite this, the exploiter’s wallet still holds around $6 million in various crypto assets, based on on-chain data. These funds remain traceable, and efforts are reportedly underway to monitor the wallet and potentially recover the stolen assets.
NEW: Yearn Finance exploited for ~$9M through near-infinite yETH token minting attack, according to PeckShield.
— Cointelegraph (@Cointelegraph) December 1, 2025
1K $ETH ($3M) was sent to TornadoCash, while exploiter's address holds ~$6M in crypto. pic.twitter.com/0XHqmTmkLB
Yearn Finance and Community Response
At the time of writing, Yearn Finance has not released a detailed post-mortem, but community discussions are ongoing. The team is likely to halt affected vaults and investigate the root cause to prevent similar exploits in the future.
This incident is a stark reminder of the risks inherent in DeFi protocols, especially those involving complex smart contracts and token minting mechanisms. The broader crypto community is closely watching how Yearn Finance handles this breach and whether affected users will be compensated.