Yearn security posts incident disclosure on the yETH hack, including recovery of 857.49 pxETH with the assistance of Plume and Dinero teams

TL;DR: Yearn’s yETH pool was exploited after an attacker broke the pool’s math, forcing the invariant to collapse and over-minting massive amounts of LP tokens. They used those fake LP tokens to drain all LSTs, then re-entered an unprotected initialization path to infinite-mint yETH and drain the Curve yETH/ETH pool too. The issue came from missing math checks, unsafe arithmetic, and an old bootstrap path left open. About 857 pxETH was recovered, but yETH is “use at your own risk,” so reimbursement depends on recovered funds only.

Top comment by @Danicjade

More coverage

• Yearn Finance yETH Pool Hit by $9M Exploit - Infosecurity Magazine (infosecurity-magazine.com)
• The $9M yETH Exploit: How 16 Wei Became Infinite Tokens (research.checkpoint.com)
• Yearn Finance Loses $9M in Single-Transaction Exploit of yETH Vault (cryptopotato.com)
• yETH Exploit of Yearn Finance, Attacker Sends Millions to To (rareevo.io)
• Yearn Finance's yETH Suffers Major Hack, Attackers Send $3M ETH ... (tradingview.com)

Explore the topic

• Hacks
• Yearn
• Security
• Plume