Which DeFi exploits hit users today?

TLDR

Todays notable DeFi exploit impacting users is Yearn Finances yETH pool, which was drained via an unlimited mint bug; Balancer also outlined reimbursements for its earlier $128M incident.

1. Yearn Finance (YFI): yETH suffered a major hack; attackers minted near?infinite tokens and routed about 1,000 ETH via Tornado Cash per coverage on the incident.
2. Balancer (BAL): maker/">DAO proposed ~$8M reimbursements to LPs after the prior $128M cross?chain exploit, with pool?specific snapshots and whitehat bounties per the reimbursement plan.
3. Trend: November alone saw ~$127M in losses to hacks/exploits across crypto per a monthly report.

Deep Dive

1. Yearn yETH Exploit

Yearns yETH pool was exploited by an infinite mint math bug, allowing the attacker to mint near?limitless yETH, drain the pool, and move roughly 1,000 ETH via Tornado Cash.

1. Yearn confirmed the incident and said V2/V3 vaults remain unaffected; coverage cites ~$9M impact and LST pool targeting in the report.
2. Additional detail on mechanics and routing through mixers appears in complementary coverage of the attack.

2. Balancer Reimbursement (Prior Exploit)

While the exploit happened earlier, Balancer today outlined a plan to return roughly $8M of rescued funds to LPs, separate from StakeWises governance?led return of osETH/osGNO.

1. The proposal uses pool?specific snapshots, proportional distributions, and 10% whitehat bounties, per the reimbursement plan.
2. Media coverage summarizes the $128M exploitation and recovery totals with pool?level payout mechanics in this update.

3. Broader Exploit Pattern

Losses from hacks/exploits remain heavy, with November tallying about $127M in crypto losses across DeFi and exchanges.

1. The monthly threat summary quantifies recent losses and highlights DeFi targeting in the report.

Conclusion

The active user?impacting exploit today centers on Yearns yETH pool, while Balancers reimbursement plan continues the recovery process from its earlier breach. In a month with heightened exploit activity, reduce permissions and reassess exposure to complex DeFi pools until fixes and audits are complete.