Which DeFi protocol was exploited?

TLDR

The DeFi protocol in the headlines for an exploit this week is Yearn Finances yETH pool.

1. Yearn Finance (YFI): About $9 million lost via an infinite?mint bug in the yETH stableswap pool, confirmed in a post?mortem and reporting on the incident.
2. US Permissionless Dollar (USPD): Roughly $1 million drained after a proxy?admin takeover during deployment, detailed in a breach report.

Deep Dive

1. Yearn Exploit

Yearn Finances yETH stableswap pool was exploited through a numerical bug that enabled minting a large amount of yETH, draining multiple pools. According to coverage and team notes, the loss was around $9 million, with a portion later recovered, and the issue was isolated to custom code used for yETH, not Yearns broader vaults. See the post?mortem details and reporting on the Yearn Finance exploit and a corroborating summary of the $9 million figure in a news brief.

2. USPD Stablecoin Incident

The US Permissionless Dollar suffered a ~$1 million loss after an attacker seized proxy admin rights during deployment, installed a shadow implementation, and later minted ~98 million USPD tokens and drained ~232 stETH, according to the projects disclosure and security community summaries. The team urged users not to buy the token, to revoke approvals, and offered a whitehat return path. See the incident summary and timeline in the USPD exploit report.

Conclusion

The exploited protocol making headlines this week is Yearn Finances yETH pool, with a separate proxy?abuse incident at USPD adding to Decembers tally. The common thread is implementation risk in specialized modules and deployment flows, so monitoring official advisories and diversifying across contracts and venues can reduce single?point exposure.