Blockchain data shows that the attacker minted nearly unlimited yETH tokens through a carefully constructed vulnerability in a single transaction, thereby completely draining the pool. The attack transaction resulted in 1,000 ETH (approximately $3.00 million at current prices) being sent to the mixing protocol Tornado Cash. The attack involved multiple newly deployed smart contracts, some of which self-destructed after the transaction. The exact scale of the loss is currently unclear, but the yETH pool was approximately $11.00 million in size before the attack.

The hack was first discovered by X user Togbe, who noticed the attack while monitoring large transfers. "Net transfers show that the over-minting of yETH allowed the attacker to somehow drain the pool and profit about 1000 ETH from it," Togbe said in a message. "Somehow some ETH was sacrificed in the process, but they still ended up profiting."

"We are investigating an incident involving the yETH LST stable swap pool," Yearn said on X. "Yearn's V2 and V3 Vaults are not affected."

Yearn Finance was previously attacked in 2021, affecting its yDAI vault, resulting in a loss of $11.00 million, with the hacker ultimately profiting $2.80 million. In December 2023, the protocol lost 63.00% of one of its vault positions due to a scripting error, but user funds were not affected. Yearn founder Andre Cronje founded the project in 2020 and left two years later.

[律动]