Yearn Finance遭遇黑客攻击，yETH漏洞导致300万美元损失

The mainstream decentralized protocol Yearn Finance has confirmed that its platform was attacked with a security vulnerability recently. On November 30th, the protocol was targeted, and Yearn’s yETH tokens became the victim of this attack.

Key points:

● A hacker exploited a “infinite minting” vulnerability in Yearn Finance’s yETH token to create an unlimited amount of yETH tokens. In just one transaction, they stole approximately $3 million from the liquidity pool.

● The stolen funds, totaling around 1,000 ETH, were laundered using Tornado Cash, a widely recognized privacy mixer.

● Yearn Finance clarified that its core infrastructure remained unaffected by this cyberattack.

It is reported that the attackers used a highly complex transaction strategy to create virtually unlimited amounts of yETH tokens. These fake tokens were then used to steal real assets worth approximately $3 million from the associated liquidity pools.

Shortly after this suspicious transaction occurred, blockchain data showed that the stolen funds (approximately 1,000 ETH) were sent through Tornado Cash. Tornado Cash is a privacy tool that makes it extremely difficult to track cryptocurrency transactions.

What is yETH?

yETH is an index of liquid staking tokens. Its purpose is to make staking easier for everyday users on the Ethereum network. yETH doesn’t require users to choose a single staking service; instead, it automatically combines various popular staking tokens, such as stETH from Lido and rETH from Rocket Pool, into a single token.

This allows users to spread the risk associated with holding income-generating assets. According to DefiLIama’s data, this product is very popular, with the total value of tokens locked in the agreement exceeding $8.82 million.

What happened with Yearn Finance ETH?

Experts point out that attackers exploited an unlimited vulnerability in the yETH smart contract. In short, this vulnerability allowed attackers to create a large number of unauthorized yETH tokens without having to provide any collateral.

(Source: Togbe on X)

On November 30th, attackers used newly created smart contracts to interact with the yETH system. These contracts tricked the system, bypassing all normal security checks. The attackers managed to create trillions of yETH tokens in just one transaction.

This large amount of worthless yETH was then immediately converted into valuable assets such as ETH and stETH within the Balancer liquidity pool. This allowed the attackers to drain the funds from the liquidity pool.

One “on-chain detective” detected suspicious activities on the network and reported that the funds had been stolen, with the attackers making a profit of approximately 1,000 ETH. After the attack, the value of the funds pool almost dropped to zero. It is reported that, after deducting transaction costs, the attackers ultimately made a profit of about $3 million.

To cover up these traces, the malicious contract used in the attack was programmed to self-destruct after stealing the data. This is a common technique used in such attacks.

The hackers quickly began laundering the money. The entire 1,000 Ethereum units were split into smaller amounts and transferred through the Tornado Cash platform. This platform is designed to conceal the traces of cryptocurrency transactions. It has been officially sanctioned by the U.S. government because it is often used by criminals to hide funds.

Yearn Finance is investigating this incident.

After the attack, Yearn Finance’s team issued a statement confirming that they are investigating vulnerabilities related to a specific yETH pool.

However, they ensured that the Yearn vault, which manages over $500 million in assets, remains unaffected. This kind of isolation helps prevent larger disasters from occurring. Yearn clarified that yETH is an experimental index that operates independently of its main security vault system.

This isn’t Yearn Finance’s first time facing cyber attacks. In April 2023, the protocol suffered a similar attack due to an outdated contract, resulting in attackers stealing $11 million.