Which DeFi exploit drained yETH?

TLDR

It was an infinite?mint bug in Yearn Finances yETH token contract that let an attacker mint near?unlimited yETH and drain the stableswap pools (report).

1. About $9 million was drained from Balancer and Curve pools after minting roughly 235 trillion yETH (analysis).
2. Roughly 1,000 ETH (~$3 million) was sent to Tornado Cash following the attack (summary).
3. Yearn said its V2 and V3 vaults were unaffected and has begun recovery and post?mortem work (update).

Deep Dive

1. Exploit Mechanics

The exploit was an infinite?mint vulnerability in the yETH token logic, triggered by a numerical bug that allowed minting a large amount of yETH and collapsing the pools accounting invariants (technical summary). Reports detail about 235 trillion yETH minted in a single transaction before liquidity was drained from the pools (on?chain recap).

2. Impact and Flows

Losses were estimated around $9 million, largely from the yETH stableswap and a smaller yETH?WETH pool (coverage). About 1,000 ETH (~$3 million) moved to Tornado Cash soon after the exploit (flow trace). Yearn later coordinated recovery of 857.49 pxETH (~$2.4 million), with assistance from external teams (recovery note).

3. Scope and Remediation

Yearn Finance (YFI) stated the issue was isolated to legacy yETH stableswap code, not its V2 or V3 vault architecture (status). A post?mortem and broader code review of older contracts are underway, with a commitment to return recovered funds to affected users (follow?up).

Conclusion

The yETH drain was caused by an infinite?mint bug in a legacy token contract, enabling mass minting and rapid liquidity removal from stableswap pools. The main vaults were not affected, some assets were recovered, and a post?mortem is in progress. If you hold or route through yETH pools, monitor official updates and consider reducing legacy?contract exposure until remediation is complete.