Yam Finance (governance takeover, September 2026) hack — September 2026

Yam Finance, a dormant DeFi DAO on Ethereum, had its governance taken over and two legacy farming contracts drained of 48.085 WETH and 763.1 UMA, about $119,400, on 14 September 2026. Defimon Alerts had warned on 2 September, when the hostile proposal was put to a vote, that about $337,000 was exposed if it passed.

According to DeFiHackLabs, the attacker bought 504,427 YAM, about 3.3% of the supply, with its own money and delegated it to itself; with almost no one else voting, that stake alone met both the proposal threshold and the quorum. Proposal 45, which had an empty description, made the attacker the pending admin of the Yam Timelock. After it passed and was executed, the attacker accepted the role, cut the Timelock delay from five days to its 12-hour minimum, took control of the UMA farming contracts from February and March 2021, settled their expired positions and transferred out the released collateral.

This registry read the attacker's token transfers: on 14 September between 02:45 and 02:48 UTC it received 23.499 WETH and 763.101 UMA from the March farming contract and 24.586 WETH from the February one, about $119,400 at the time. That amount is recorded. The attacker then moved the funds on, and DeFiHackLabs reports a cash-out through FixedFloat. No statement from Yam has been found.