What caused the DeFi pool exploit?

TLDR

The recent DeFi pool exploit was caused by a smart?contract math bug that enabled infinite minting, letting the attacker drain liquidity in one transaction.

1. Yearn Finances yETH pool: a math error allowed minting ~235 trillion yETH, then draining ~$89 million from stableswap pools (analysis).
2. Balancer V2: a vault interaction vulnerability combined with batched swaps manipulated price calculations across chains (overview).
3. Part of the proceeds (~1,000 ETH) were mixed via Tornado Cash to obfuscate flow (report).

Deep Dive

1. Yearn yETH Bug

A low?level numerical bug plus invariant?management issues in the yETH contract enabled an infinite?money glitch, allowing the attacker to mint ~235 trillion yETH and drain the pool in a single transaction. Yearn said the impact was isolated to its custom yETH stableswap pool; V2 and V3 Vaults were not affected (post?incident coverage).

• The attacker minted unlimited yETH, hit the stableswap pool, and realized ~$89 million, with on?chain evidence of rapid mint?and?drain execution (technical summary).
• The issue reflects math/invariant errors that can slip past audits, especially when optimization trade?offs complicate precision and state handling (overview).

2. Balancer V2 Vulnerability

Separately, Balancers V2 vaults were exploited via a smart?contract interaction vulnerability. Attackers combined it with batched swaps to manipulate price calculations and drain multiple pools across Ethereum, Polygon, Base, and Arbitrum (incident summary).

• Despite prior audits, the flaw persisted and was exploited at scale, leading to one of the years largest DeFi losses (overview).
• Balancer later proposed ~$8 million in recovered fund reimbursements to affected LPs, using snapshot?based distributions and dedicated claims processes (the report above).

3. Funds Flow And Evasion

Attackers moved roughly 1,000 ETH through Tornado Cash to obscure provenance, and used short?lived helper contracts that self?destructed after forwarding funds, complicating post?mortem tracing (transaction flow).

• Single?transaction drains with self?destruct helpers reduce on?chain code artifacts, leaving logs as the main forensic trail (technical details).
• Recovery depended on rapid pausing and whitehat rescues, with partial fund retrieval documented in Balancers reimbursement proposal (the overview above).

Conclusion

Root cause was algorithmic: a numerical bug enabling infinite minting in Yearns yETH, and a separate vault?interaction vulnerability in Balancer combined with batched swaps. The takeaway is that math precision and invariant safety are as critical as audits. For users and LPs, favor protocols with robust pause policies, independent monitoring, and clear recovery playbooks.