🤑 Infinite yETH: How One Hacker Turned Code into a $9M Comedy 🎭

by

In the depths of the digital abyss, where greed and genius intertwine like the serpents of old, Yearn Finance has fallen prey to a spectacle most grotesque. A legacy yETH product, once a beacon of trust, has been desecrated by a mind both cunning and merciless. The attacker, a modern-day Raskolnikov, minted an endless sea of yETH tokens, as if the very fabric of reality could be rewritten with a single stroke of code. 🖥️✨

According to the whispers of the blockchain, this digital alchemist conjured a near-infinite supply of yETH in a solitary transaction, a feat so audacious it borders on the absurd. With these phantom tokens, they plundered ETH and liquid-staking derivatives from liquidity pools, leaving behind a trail of devastation. The deed was uncovered on November 30, 2025, and the toll stands at a staggering $9 million. 💸🔥

#PeckShieldAlert Yearn Finance @yearnfi suffered an attack resulting in a total loss of ~$9M. The exploit involved minting a near-infinite number of yETH tokens, depleting the pool in a single transaction. ~1K $ETH (worth ~$3M) was sent to #TornadoCash, while the exploiter’s soul was sold to the void. 😈

– PeckShieldAlert (@PeckShieldAlert) December 1, 2025

Exploit aftermath

The Devil in the Details

Ah, the exploit! A flaw in the yETH minting logic, a chink in the armor of code, allowed the attacker to produce 235 trillion tokens in one fell swoop. These tokens, as worthless as a philosopher’s promises, were swapped for real assets from Balancer and Curve pools. The liquidity vanished in minutes, a testament to the speed and ruthlessness of the digital age. ⏳💨

At 21:11 UTC on Nov 30, an incident occurred involving the yETH stableswap pool that resulted in the minting of a large amount of yETH. The contract impacted is a custom version of popular stableswap code, unrelated to other Yearn products. Yearn V2/V3 vaults are not at risk. Or so they say. 🤔

– yearn (@yearnfi) December 1, 2025

The Spoils of Sin

The attacker, with a heart as cold as the blockchain itself, pulled $8 million from the main yETH stable-swap pool and $0.9 million from a yETH-WETH pool. In a final act of defiance, they sent 1,000 ETH-worth $3 million-to Tornado Cash, attempting to obscure their trail like a criminal fleeing into the fog of a Dostoevskian novel. 🌪️🕵️‍♂️

Asset movement

The Aftermath: A Tale of Isolation and Woe

Yearn officials, in their infinite wisdom, claim the breach was confined to an older, legacy implementation of the yETH product. The affected pool was isolated, and the investigation began with the fervor of a man searching for meaning in a godless world. User funds in active vaults, they assure us, remain untouched. But who can trust the words of those who build castles on sand? 🏰💨

The Market Reacts: A Chorus of Despair

The crypto markets, ever sensitive to the winds of fear, saw selling pressure as the news spread. Traders, like characters in a tragic farce, weighed the risks of combining liquid staking tokens with custom swap code. Yearn Finance, in a display of contrition, is working with external security teams to conduct a post-mortem and patch the vulnerability. But will it be enough to restore faith in a system built on trust and code? 🤷‍♂️

The protocol’s notice, a somber warning, urged users to exercise caution while the review continues. But in the world of crypto, caution is a luxury few can afford. 🕰️⚠️

Read More

2025-12-01 16:39