$3 million in ETH sent to Tornado Cash following apparent attack on Yearn’s yETH
Yield-farming protocol Yearn Finance appears to have been targeted by an attack that drained millions of dollars worth of liquid staking tokens (LSTs) from its Yearn Ether (yETH) product, which aggregates popular LSTs into one token. Blockchain data show the yETH pool was apparently drained through a carefully formed exploit that minted a near-infinite number of yETH tokens, draining the pool in a single transaction. As a result of the transaction, 1,000 ETH (worth about $3 million at current prices) was sent to mixing protocol Tornado Cash.The attack seemingly involved several freshly-deployed smart contracts, some of which self-destructed following the transaction, blockchain data shows. The total scale of the financial loss was initially unclear, while the yETH pool had about $11 million in value before the attack. The hack was first flagged by X user Togbe, who told The Block that they noticed the apparent attack while monitoring large transfers. "Net transfers suggest yETH super mint let the attacker drain the pool for some gain of 1k ETH," Togbe said in a message. "Somehow other eth was sacrificed in this but they still [made] away with profit.""We are investigating an incident involving the yETH LST stableswap pool," Yearn wrote on X. "Yearn Vaults (both V2 and V3) are not affected."In a new announcement published 11:10 p.m. on Sunday, Yearn confirmed that it has lost $9 million from the attack — $8 million from the stableswap pool and $0.9 million from the yETH-WETH stableswap pool on Curve. Yearn said a full post-mortem investigation is underway, in collaboration with SEAL 911 and ChainSecurity."Initial analysis indicated this hack has a similar high complexity level to the recent Balancer hack, so please bear with us as we perform the post-mortem analysis," Yearn wrote in the post. "There is no other Yearn product using similar code to what was impacted."Yearn Finance suffered an exploit in 2021 that affected its yDAI vault, which lost $11 million in value, with the hacker getting away with $2.8 million. In Dec. 2023, the protocol said a faulty script wiped out 63% of one of its treasury positions, but no user funds were affected. Andre Cronje, who founded Yearn in 2020, departed the project two years later. The Block could not immediately reach Yearn for comment. This is a developing story. Story updated to add Yearn's follow-up announcementDisclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.