An old DeFi protocol has encountered issues again.

The liquidity staking aggregator yETH under Yearn Finance was hacked today, with the entire fund pool nearly drained. The attack method was quite ruthless — the hacker exploited a contract vulnerability to achieve almost "infinite minting," draining the pool with a single transaction and transferring 1000 ETH (approximately 3 million USD) into the Tornado Cash mixer.

On-chain data shows clearly: multiple newly deployed smart contracts participated in this action, and after it was completed, these contracts immediately self-destructed to erase traces. Before the incident, the total value lying in the yETH pool was approximately 11 million USD, and the exact amount that has evaporated is still being calculated, but the losses are definitely not small.

Interestingly, this issue was not discovered by the project team but was first noticed by Twitter user Togbe, who observed a large number of suspicious interactions involving protocols like Balancer and Rocket Pool, along with the frequent calls to Tornado Cash, which basically confirmed it was an attack. The Yearn team later responded that their Vault product was not affected, but yETH users were probably sweating a bit.

This kind of "minting-draining-mixing" combination has already been seen multiple times in the DeFi space. No matter how strict the smart contract audits are, they can't withstand hackers who are constantly thinking of new ideas to target your fund pool day and night.