Which DeFi exploit drained staked ETH?

TLDR

It was the Yearn Finance (YFI) yETH stableswap infinite?mint exploit that minted fake yETH and drained ETH and liquid staked ETH from liquidity pools.

1. About $9 million was lost, and Yearn said V2/V3 vaults were not affected in an incident update on X (Yearn post).
2. The attacker minted roughly 235 trillion yETH, then pulled ETH and LSTs, sending about 1,000 ETH through Tornado Cash (Crypto.news report).
3. A portion was recovered, including 857.49 pxETH worth around $2.4 million, per a post?mortem update (Defiant coverage).

Deep Dive

1. What Happened

The exploit hit Yearns yETH stableswap pool via an infinite?mint bug that allowed the attacker to create massive yETH and swap it for real assets. Coverage notes the pool aggregated staked ETH derivatives such as stETH and rETH, and the attacker drained value from that custom pool (CryptoPotato analysis).

2. Scope and Impact

Yearn said roughly $9 million was taken across the main yETH stableswap pool and a smaller yETH?WETH pool, while core V2/V3 vaults were unaffected (Yearn post). Reports also highlight about 1,000 ETH routed through Tornado Cash shortly after the attack (Yahoo summary).

3. Aftermath and Recovery

Follow?ups describe a coordinated response and partial recovery of 857.49 pxETH, about $2.4 million, alongside a war room with security partners and auditors (Defiant coverage). Additional detail on the exploit path and the initial laundering flows appears in incident roundups (Crypto.news report).

Conclusion

The staked ETH drain youre referring to stems from the Yearn yETH infinite?mint exploit, which targeted a custom LST stableswap pool and siphoned real ETH and LST liquidity. Losses were significant but contained to that product, with partial recovery reported and core Yearn vaults unaffected per the official update.