Yearn Finance Loses $9M in Single-Transaction yETH Vault Exploit

Yearn Finance has suffered a major exploit. An attacker drained approximately $9 million from the protocol’s yETH liquidity pool in a single transaction, manipulating the pool’s pricing invariant to mint an astronomical amount of tokens.

The incident stands out even in a sector accustomed to security breaches, because of how it unfolded: everything happened inside one transaction, the loss was concentrated in a single liquidity pool, and a partial recovery effort was still under way even as some of the proceeds had already been moved through a privacy tool.

How the Attack Worked

According to a hack analysis by Quillaudits, the attacker executed the exploit in one transaction at block 23,914,086. The sequence began with highly imbalanced liquidity deposits that pushed the pool’s custom stableswap invariant into unstable territory. The Newton-Raphson solver, fed distorted inputs, then produced inconsistent supply values that let the attacker mint far more LP tokens than should have been possible.

To understand why that matters, it helps to know what these pieces do in general terms. A liquidity pool that holds several similar assets needs a rule for pricing them against one another, and that rule is often called an invariant: a mathematical relationship the pool tries to preserve as deposits, withdrawals, and swaps change its balances. A stableswap-style invariant is designed for assets that are meant to trade near parity, so it keeps prices close together when balances are roughly even. When balances become severely lopsided, however, the formula can behave very differently from how it behaves in normal conditions, and that is exactly the territory the attacker pushed it into.

The Newton-Raphson method is a standard numerical technique for finding solutions to equations by refining a guess, step by step, until it converges. Pool contracts sometimes use such a solver to work out how many tokens a deposit or withdrawal should produce. A solver is only as reliable as its inputs and its starting conditions. Feed it a badly distorted state, and it can return an answer that looks precise but is wrong, and a contract that trusts that answer without further checks can then hand out far more tokens than the deposit behind it justifies. That appears to be the core of this exploit: the distorted invariant produced inconsistent supply values, and the contract minted LP tokens on the basis of those values.

After draining the pool’s liquid staking tokens, including wstETH, rETH and cbETH, the attacker triggered the contract’s bootstrap initialization logic with a dust-level deposit of just 16 wei. An underflow wrapped a negative value into a massive positive number, minting over 2.3 x 10^56 yETH, which was immediately swapped in the yETH/WETH Curve pool for roughly 298 WETH.

An underflow is a classic arithmetic failure in computing. When a calculation produces a result below the smallest value a number type can hold, the value can wrap around to the largest possible value instead, turning a small negative number into an enormous positive one. In this case, that wrap-around is what produced the astronomical token mint. The attacker then converted that freshly minted balance through an existing Curve pool, turning an accounting error into real, withdrawable value. The fact that a dust-level deposit, an amount so small it is effectively negligible, could trigger the initialization path at all is itself part of the story: bootstrap logic is meant to run once, at the very beginning of a pool’s life, and any route that lets it run again later is a serious design risk.

Why a Single Transaction Matters

The single-transaction nature of the exploit is worth pausing on. In traditional finance, a theft of this size would typically require many steps over time, each of which creates a chance for detection or intervention. On a blockchain, a transaction is atomic: either every step inside it succeeds together, or the whole thing reverts. An attacker who can chain deposits, price distortion, minting, and swaps into one atomic sequence does not need to survive any intermediate state. There is no moment halfway through when a monitor can freeze the funds, because nothing is final until the transaction completes, and by then the value has already moved.

Funds on the Move

The stolen assets were converted to ETH through decentralized exchanges. About 1,000 ETH went through Tornado Cash, while roughly $6 million remained untouched in the attacker’s address.

Those two details sketch the usual fork in the road after a large exploit. One portion of the funds is moved through a privacy tool, which breaks the on-chain trail between the attacker’s address and any later destination, and is generally read as an attempt to make the proceeds harder to trace or freeze. The other portion sitting untouched suggests the attacker had not yet decided what to do with the remainder, or was waiting to see how the response developed before moving it. Untouched funds are also the funds most amenable to recovery efforts, since they have not yet passed through obfuscation or been converted into other assets.

The Recovery Effort

Yearn’s war room, assembled with SEAL911 and audit partner ChainSecurity, managed to recover 857.49 pxETH worth about $2.33 million.

SEAL911 is a well-known incident-response channel in the crypto security community, used to coordinate white-hat responders quickly when an exploit is under way. The involvement of ChainSecurity, an audit partner, points to the kind of forensic work these recoveries require: tracing which contracts were touched, which balances were affected, and whether any portion of the funds can be clawed back through cooperation with other protocols or infrastructure providers. A recovery of this size is meaningful, but it is also partial. Measured against the approximately $9 million drained, it leaves the majority of the loss unrecovered, which is the more common outcome in DeFi exploits than a full return of funds.

Yearn confirmed its V2 and V3 vaults were not affected. That distinction matters because it confines the incident to the yETH liquidity pool and its particular pricing and initialization logic, rather than to the vault products that most Yearn users interact with. When a protocol confirms that its flagship products are untouched, it is drawing a boundary around the damage, and that boundary is what lets the rest of the protocol keep operating while the affected pool is dealt with. Users of the unaffected vaults were not, on the facts reported, exposed to this particular exploit.

A Rough Stretch for DeFi Security

The incident follows the Balancer hack that drained more than $120 million and a $50 million security lapse at Korean exchange Upbit, making this one of the roughest stretches for DeFi security this year.

Read together, the three incidents illustrate different faces of the same underlying problem. A decentralized exchange protocol, a centralized exchange, and a yield protocol’s liquidity pool were all hit in close succession, through different mechanisms and at very different scales. That breadth is what makes the stretch feel so rough: it is not one kind of platform failing repeatedly, but several kinds of platform failing in different ways, which makes it harder to point to a single fix. For the sector as a whole, the pattern reinforces a familiar lesson, which is that security in crypto is not a one-time audit or a single safeguard, but an ongoing contest between increasingly sophisticated attackers and the teams defending increasingly complex systems.

What This Means for DeFi Builders and Users

For builders, the exploit is a case study in how custom pricing logic creates custom risk. A standard, battle-tested formula has usually survived years of adversarial attention, while a custom invariant introduces new edge cases that may only reveal themselves under extreme imbalance. Numerical solvers add a second layer of subtlety, because their output depends on inputs that an attacker may be able to manipulate. And initialization logic that can be re-triggered after launch is a known hazard class that deserves explicit guards, so that a bootstrap path can only ever run once. None of these observations is a guarantee against future exploits, but together they describe the kinds of checks and constraints that audits and formal reviews tend to focus on after an incident like this one.

For users, the incident is a reminder that even established protocols carry smart-contract risk, and that different products within the same protocol can carry different risk profiles. The fact that V2 and V3 vaults were unaffected while the yETH pool was drained shows that exposure depends on the specific product and pool, not merely on the brand name attached to it.

Frequently Asked Questions

How much did the Yearn Finance exploit drain?

Approximately $9 million was drained from the protocol’s yETH liquidity pool in a single transaction.

How did the attacker mint so many tokens?

Highly imbalanced deposits pushed the pool’s custom stableswap invariant into unstable territory, the Newton-Raphson solver produced inconsistent supply values, and a later underflow wrapped a negative value into a massive positive number, minting over 2.3 x 10^56 yETH.

What did the attacker do with the minted tokens?

The minted yETH was swapped in the yETH/WETH Curve pool for roughly 298 WETH, and the stolen assets were then converted to ETH through decentralized exchanges, with about 1,000 ETH going through Tornado Cash.

How much was recovered?

Yearn’s war room, assembled with SEAL911 and audit partner ChainSecurity, recovered 857.49 pxETH worth about $2.33 million, while roughly $6 million remained untouched in the attacker’s address.

Were Yearn’s V2 and V3 vaults affected?

No. Yearn confirmed its V2 and V3 vaults were not affected, and the incident was confined to the yETH liquidity pool.

Source: CryptoPotato / Quillaudits

Related reading on MM Crypto Analysis Web

• Ethena Earn+ Vault Puts 11x Leverage Behind a 12% Yield Target
• Ibis Onchain Credit Emerges With $250M FalconX Facility
• Phantom Prediction Markets Arrive for US Users Through Kalshi

More in DeFi on MM Crypto Analysis Web.