Yearn Finance (yETH pool) hack — November 2025

Yearn Finance's yETH pool, a weighted stableswap holding a basket of liquid staking tokens including apxETH, sfrxETH and wstETH, was exploited on 30 November 2025 at Ethereum block 23,914,086. About $9 million in liquid staking tokens and WETH left a pool that had held roughly $11 million. Yearn said its v2 and v3 vaults, with more than $410 million in deposits, were unaffected and that the damage was confined to yETH and its Curve integration.

The bug was arithmetic. According to Yearn's post-mortem, a sequence of imbalanced add_liquidity deposits pushed the pool's iterative fixed-point solver into a divergent state until an internal product term collapsed to zero. That broke the weighted-stableswap invariant, and an unchecked subtraction then underflowed, letting the attacker mint an enormous quantity of yETH LP tokens against a deposit of 16 wei spread across the pool's eight supported assets. Check Point Research describes the same outcome from a different angle: cached virtual-balance values held in packed storage were never cleared when liquidity was fully withdrawn, so a later deposit into a pool reading zero supply was priced against stale phantom balances.

The attacker swapped the minted tokens for wrapped ether, repaid flash loans and routed roughly $3 million in ETH through Tornado Cash. Yearn convened a war room with SEAL 911 and, working with the Plume and Dinero teams, clawed back 857.49 pxETH on 1 December, worth about $2.4 million, which it said would go pro rata to yETH depositors based on balances immediately before the exploit. Yearn stated that contributors are not liable for reimbursement under the product's use-at-own-risk terms. ChainSecurity assisted with root-cause analysis. No attacker has been identified.