yearn.finance (YFI)

I’m finding it difficult to fully understand how a single transaction caused a $9M loss to @yearnfi . It’s a very complex txs, and one key element that helped the attacker was the flash loan taken from Balancer. Breakdown HOW IT WORKED (Step-by-Step) 1. Flash Loan Setup The attacker borrowed a large amount of liquid-staking tokens (LSDs) from Balancer: 4,000 wstETH (~$14.7M) 300 rETH (~$1M) 3,100 WETH (~$9.3M) 2. Deposit into yETH Vault All the borrowed assets were deposited into Yearn’s yETH vault, and the attacker received yETH shares in return. 3. Core of the Exploit The attacker repeatedly: Deposited different LSDs (wstETH, rETH, ETHx, cbETH, etc.) into the vault Swapped tokens in Curve pools to manipulate Yearn’s underlying asset ratios Unwrapped/converted tokens (e.g., wstETH → stETH) Withdrew from the vault when the manipulated share value was higher Key vulnerability: The yETH vault’s share-price calculation could be manipulated by shifting the ratio of its underlying assets. By looping deposits, swaps, and withdrawals, the attacker artificially inflated the value of their shares. 4. Repeated Cycles When you examine the token flows, the attacker performs multiple cycles of: Minting yETH by depositing LSDs Burning yETH to withdraw Repeating with slightly adjusted amounts Each cycle extracted profit because the manipulated share price continued to rise. 5. Complex Token Routing The attacker used multiple protocols to support the manipulation, including: Curve pools (st-frxETH, pxstETH, pxETH/WETH) Aave (for additional borrowing) Dinero / Pirex (for pxETH / apxETH interactions) Frax (for sfrxETH conversions) 6. Final Extraction After completing the exploit, the attacker: Sent 1,000 ETH to Tornado Cash 128 ETH in another address 0xa80D3F2022F6Bfd0B260bF16D72CaD025440C822 The attacker had already received 0.00349125 ETH from Railgun about an hour before the exploit, likely to prepare for the attack. Stay Smart

Yearn Finance Hacked Purane contract me ek bug tha jisko use karke unlimited $yETH bana kar attackers ne $ETH drain kar liya $9 Million drain hone ke baad panic me $YFI bhi dump hona start ho gaya Ek purane contact be issue ke wajah se $9 Million ka loss hogaya isliye projects ko sabh kuch updated and safe rakhna bahut jaruri hai

🚨 Yearn Finance Exploit – $9M Gone A bug in Yearn’s old yETH contract let an attacker mint fake tokens and drain the pool. -$9M stolen -1,000 ETH sent to Tornado - Attacker still holds ~$6M Yearn confirmed the issue was only in the retired contract. Old DeFi code = hidden risks.

🚨JUST IN: Yearn Finance exploited for ~$9M after an attacker executed a near-infinite yETH minting exploit. 1,000 $ETH (~$3M) has already been sent to @TornadoCash. The exploiter’s wallet still holds ~$6M in crypto. https://t.co/apb6yKQ2ch

🚨Just in: Yearn Finance (@yearnfi) suffered a $9M exploit via a near-infinite yETH token minting attack. ➡️About 1,000 $ETH ($3M) went to #TornadoCash, and the attacker’s wallet retains around $6M in #crypto. #CoinPedia #CryptoNews #Blockchain #CryptoMarket #CryptoHack

🚨 Yearn Finance Hack Alert! 🚨 A major security vulnerability was discovered in Yearn Finance’s yETH token contract. The attacker stole millions of dollars worth of ETH and liquid stake assets from Balancer pools. Crypto users should be careful and safeguard their funds! #CryptoHack #YearnFinance #Ethereum 📌 𝗡𝗢𝗧: This content is an automatic market summary generated by our AI-powered analysis system, which interprets current crypto news sources and market data. It is not investment advice.

Just In: @yearnfi has been exploited and lost around $9M.

Another day, another hack. At this point, there should be a website which shows which projects HAVEN’T been hacked.