yearn

According to PeckShield monitoring, Yearn Finance V1 (@yearnfi) has been hacked, resulting in a total loss of approximately $300,000.The attacker has exchanged the stolen funds for 103 ETH, and these assets are currently stored at address 0x0F21...4066.

According to The Block, HumidiFiYearn Finance has released a detailed post-mortem report on last week's yETH vulnerability attack, pointing out a three-phase numerical error in its legacy stableswap liquidity pool that allowed attackers to "mint" LP tokens infinitely and steal approximately $9 million in assets from the liquidity pool.Yearn confirmed that, with the assistance of the Plume and Dinero teams, it successfully recovered 857.49 pxETH, which accounts for about a quarter of the stolen assets. The team plans to proportionally distribute the recovered funds to yETH depositors.The decentralized finance protocol stated that the vulnerability attack occurred on November 30, 2025, at block 23,914,086, where the attacker forced the internal parser of the liquidity pool into a divergent state through a complex sequence of operations, ultimately triggering an arithmetic underflow. The attack targeted a custom stableswap pool aggregating various liquid staking tokens (LSTs) and a yETH/WETH Curve pool.Yearn emphasized that its v2 and v3 vaults and other products were not affected. To address these issues, Yearn announced a remediation plan, including implementing explicit domain checks on the parser, replacing unsafe arithmetic in critical parts with checked arithmetic, and disabling bootstrap logic after the pool goes live, among other measures.

According to SlowMist monitoring, the decentralized finance protocol Yearn has suffered a hacking attack, resulting in a loss of approximately $9 million.The SlowMist security team analyzed the incident and confirmed the root cause as follows: The vulnerability originated from the logic of the _calc_supply function used to calculate the supply in the Yearn yETH weighted stablecoin swap pool (Weighted Stableswap Pool) contract. Due to unsafe mathematical operations, this function allowed for overflow and rounding errors during calculations, leading to significant discrepancies in the product of the new supply and the virtual balance. Attackers exploited this flaw to manipulate liquidity to a specific value and over-mint liquidity pool (LP) tokens, thereby profiting illegally. It is recommended to strengthen boundary scenario testing and adopt security-verified arithmetic mechanisms to prevent similar high-risk vulnerabilities such as overflow in similar protocols.Previously, Yearn released a statement stating that its yETH stable pool was attacked on November 30 at 21:11 UTC, with attackers minting a large amount of yETH through a custom contract, resulting in approximately $8 million in assets being damaged in the pool, and an additional loss of about $900,000 coming from the yETH-WETH pool on Curve.

PeckShield posted on the X platform that yearn recovered $2.4 million by burning the hacker's pxETH and minted the same amount of tokens on the Redacted Cartel multi-signature.

The founder of Slow Fog, Yu Xian, tweeted that the "white hat negotiation" message that appeared on-chain after the Yearn attack is fabricated and is actually a phishing attempt, consistent with the previous Balancer incident.The attacker used the Railgun protocol to hide their identity, prepared a low Gas address 28 days in advance, and completed the exploit, ultimately transferring 1,000 ETH through Tornado Cash. The current attacker address still holds about 6 million dollars in cryptocurrency assets.

Yearn released a statement saying that its yETH stable pool was attacked on November 30 at 21:11 UTC. The attacker minted a large amount of yETH through a custom contract, resulting in approximately $8 million in assets being compromised in the pool, with an additional loss of about $900,000 from the yETH-WETH pool on Curve. Yearn stated that the affected code is unrelated to other products, and both V2/V3 Vaults were not impacted. They mentioned that the complexity of the incident is similar to the previous attack on Balancer. The team is currently conducting an investigation in conjunction with SEAL911 and the auditing firm ChainSecurity.

Yearn tweeted that the recent attack related to yETH did not affect the yCRV product.

According to The Block, Yearn Finance's aggregated staking token product yETH was attacked, allowing the attacker to mint yETH almost infinitely through a vulnerability, depleting the pool's assets in a single transaction.On-chain data shows that the attacker subsequently transferred about 1000 ETH (approximately 3 million USD) into the mixing protocol Tornado Cash. Several contracts used for the attack self-destructed after the transaction. The exact scale of the losses is still unclear, and Yearn stated that it is investigating the incident, with its V2 and V3 Vaults unaffected.

ChainCatcher news, according to DLNews, anonymous contributor 0xPickles recently submitted a comprehensive reform proposal aimed at reshaping the development trajectory of the DeFi protocol Yearn Finance.The proposal's three plans attempt to revitalize the project through income distribution reform, enhanced contributor accountability, and shared token value. The core transformation of the proposal is that 90% of the protocol's income will be directly distributed to holders of locked YFI tokens.Under the new mechanism, users can participate in income distribution by staking YFI to obtain stYFI certificates. Specifically, this includes:Staking model replaces voting escrow: Eliminating complex mechanisms and adopting direct staking for income distributionDAO governance restructuring: Establishing a profit-centered decision-making mechanism, requiring contributor budget applications to include on-chain financial reportsInstitutionalized contributor incentives: Allocating 1,700 YFI (approximately $500,000) for strategic incentives, setting a cap on performance bonuses and a retention pool for long-term contributors.

ChainCatcher message, regarding LayerZero's forced donation behavior, Yearn core developer banteg stated on social media that mandatory donations resemble a beautified ICO. He also called for an end to the bulk funding of ProtocolGuild, as it has already successfully attracted funding and should seek other smaller initiatives to support.

ChainCatcher message, Yearn core developer banteg posted on social media: "Ape Safe (Ape version) is preparing to launch to the public. A lot of work will be put into building an excellent safe wallet client. Users will be able to use the wallet just like using a private key account. Making transactions as simple as contract.method(sender=safe)."

ChainCatcher message, yearn posted on platform X stating that it has several Sonne strategies on Optimism. Sonne has paused its market, which means users are currently unable to withdraw from these Vaults.Additionally, yearn contributors are working with the Sonne finance team to provide assistance and support as much as possible.

ChainCatcher news, Yearn announced that it will launch the new YBS staking system for yPRISMA on Thursday (May 9) at 00:00 UTC according to the YIP-77 proposal. All yPRISMA stakers need to migrate their assets to continue earning staking rewards. The best migration period is within one week after the new system goes live. Users can choose to deposit into the new yPRISMA Yearn gun pool yvyPRISMA, or directly stake into the new Yearn Boosted Staker (YBS).It is reported that the yvyPRISMA option is suitable for users who want to increase their yPRISMA positions and are more concerned about Gas costs. The YBS direct staking option is suitable for users who want to earn stablecoin rewards, do not mind additional Gas costs, and expect to become long-term participants in the ecosystem.In addition, YBS adopts an innovative mechanism to incentivize long-term stakers by providing them with higher rewards. Rewards will be distributed in the form of Yearn gun pool wrapped stablecoin yvmkUSD-A, which can be claimed at the beginning of the week after staking for a full week.To ensure safety, the reward contract will ignore the staking amount during the first week of staking. Therefore, no users will be eligible to receive the 1x boost before May 23 after the new system goes live. Users who complete the migration within the migration week (before May 16, 00:00 UTC) can claim the accumulated double rewards on that day.Users who migrate after the migration period will miss out on a week of double rewards. The original yPRISMA staking contract will be deprecated this Thursday.

ChainCatcher news, the yield aggregation protocol Yearn announced on social media that Vaults v3 has been launched on the Ethereum mainnet.

ChainCatcher news, the DeFi aggregator Yearn Finance stated that a faulty multi-signature script affected 63% of Yearn's LP positions in Lp yCRV, resulting in a total loss of $1.4 million before funds could be returned, which accounts for about 2% of the entire treasury funds, with no user funds affected.According to a disclosure post on Github, the incident occurred during the "routine fee token conversion process on behalf of the Yearn treasury." The faulty script led to the exchange of 3,794,894 lp-yCRVv2 tokens for 779,958 yvDAI tokens.