Which protocol suffered yETH exploit?

TLDR

Yearn Finance (YFI) was the protocol hit by the yETH exploit, which targeted its yETH stableswap pool and led to significant losses, confirmed by multiple reports and the teams post. See the Yearn Finance exploit coverage.

1. Attackers minted near?infinite yETH, then drained liquidity from yETH pools, per a news report.
2. Losses are estimated around $9 million, with roughly 1,000 ETH sent to Tornado Cash, per a market update.
3. Yearn said V2/V3 Vaults were not affected and isolated the issue to yETH pools in an official post.

Deep Dive

1. Exploit Mechanics

The incident combined a low?level math bug with an invariant?management issue in yETH, allowing attackers to mint an unlimited supply and then siphon assets from a custom stableswap pool. See the technical summary and the glitch report.

1. Reports indicate infinite yETH was minted and swapped into ETH and LSTs, draining pools (Defiant).
2. Coverage highlights helper contracts used in a single?transaction drain (Yahoo Finance).

2. Scope and Funds Flow

Estimates point to about $9 million in losses, with approximately 1,000 ETH routed through mixing services, and additional staked ETH assets remaining in attacker wallets. See a market brief and a detailed incident recap.

1. The stableswap pool initially held about $11 million before the drain (Yahoo Finance).
2. Tornado Cash transfers and remaining on?chain balances are documented in coverage (CryptoPotato).

3. Containment and Exposure

Yearn indicated the issue was isolated to yETH?related pools and confirmed core V2/V3 Vaults were unaffected. Other protocols clarified they had no exposure to yETH. See Yearns official update and ether.fis safety note.

1. Yearn emphasized no similar code is used elsewhere in the protocol (Defiant).
2. ether.fi stated its ETH vault products had no yETH exposure (ether.fi statement).

Conclusion

The yETH exploit hit Yearn Finances stableswap infrastructure via an infinite mint vector, resulting in material pool losses and some funds funneled through mixers. The teams communication suggests the impact was confined to yETH?specific contracts, reducing broader protocol contagion, but affected users should track post?mortem and remediation steps closely.