Hackers Exploit Critical Yearn Finance’s yETH Pool Vulnerability to Steal $9 Million in Ethereum

On November 30, 2025, Yearn Finance's yETH pool experienced a significant security breach, resulting in the unauthorized extraction of approximately $9 million.

The attacker executed a sophisticated exploit that involved minting an enormous quantity of 235 septillion yETH tokens by depositing just 16 wei. This action underscores vulnerabilities in complex smart contract systems, particularly in relation to mathematical invariants and gas optimization strategies.

The core issue was identified within the protocol's internal accounting mechanism, specifically through the use of cached storage variables known as packed_vbs . These variables, intended to reduce transaction costs by storing virtual balance information, failed to reset properly when the pool's liquidity supply dropped to zero.

While the main supply counter reset, the cached values mistakenly retained balances from previous transactions, leading to a critical discrepancy between the actual and recorded state of the pool.

Check Point security analysts identified the flaw as a logic error in state management, rather than a simple coding mistake. By manipulating the interaction between deposit and withdrawal functions, the attacker misled the system into recognizing a substantial pool value, even though it was effectively empty.

The attack, noted for its capital efficiency, required minimal upfront investment to extract millions in Ethereum-based assets.

The attack was executed through a process of state poisoning, exploiting the protocol's failure to clear its cache. The perpetrator conducted multiple cycles of deposits and withdrawals using flash-loaned funds, leaving small residual values in the packed_vbs storage slots.

This repetitive action poisoned the storage with accumulated data that persisted even after the attacker withdrew all legitimate liquidity, reducing the pool's total supply to zero.

Critically, the protocol’s add_liquidity function contained a flawed assumption: a zero supply was presumed to indicate a pristine, empty pool. Consequently, when the attacker deposited their final 16 wei, the system read the stale, non-zero values from the poisoned cache instead of recalculating based on the new deposit.

This misjudgment triggered the minting of septillions of LP tokens, granting the attacker control over the pool's assets, which were then exchanged for WETH and laundered via Tornado Cash.

This incident highlights the necessity for explicit state management in complex DeFi systems to prevent similar high-value exploits.

Based on reporting by Cyber Security News.