Yearn yETH Exploit — Infinite Mint Drains ~1,000 ETH, Funds Routed to Tornado Cash
Yearn Finance’s yETH vault was exploited on Nov. 30, 2025 after attackers triggered an unlimited mint of the yETH liquid-staked ETH (LST) index token and emptied the vault in a single transaction. On-chain data shows the attacker minted near-infinite yETH, withdrew roughly 1,000 ETH (about $3 million) from a pool that held about $11 million, and routed proceeds through Tornado Cash. The exploit used newly deployed smart contracts that self-destructed after the transaction. Yearn confirmed the breach, paused the affected yETH vault, said V2 and V3 vaults were unaffected, and engaged independent auditors to review and patch the minting logic vulnerability. The incident follows a broader increase in DeFi losses — CertiK reported about $127M lost to hacks in November — and echoes Yearn’s past incidents (yDAI in 2021, treasury script in 2023). Traders should watch Yearn announcements, on-chain flows from the exploit addresses, and any recovery or reimbursement plans. Immediate risk-management steps: reduce or withdraw exposure to yETH and related LST products, monitor liquidity and oracle behavior, and flag older or complex vault contracts as higher risk.
Bearish
The exploit directly impacts yETH, a Yearn LST product, by draining vault liquidity and undermining trust in its minting logic. Short-term market impact on yETH and related Yearn products is likely bearish: immediate withdrawals, reduced inflows, and elevated volatility as traders flee perceived risk and on-chain holders rebalance. Routing funds through Tornado Cash also reduces recovery prospects and heightens counterparty/AML concerns, which can further depress demand. In the medium term, price pressure may persist if Yearn’s remediation is slow or incomplete and if arbitrageurs and liquidity providers avoid yETH. However, if Yearn patches the contract quickly, offers transparent remediation or reimbursement, and restores confidence, downward pressure could be mitigated over weeks to months. Overall, the event increases perceived risk for liquid staking derivatives (LSTs) and older/complex vault contracts, likely keeping investor caution elevated and liquidity lower for the affected token until clear recovery actions are delivered.