Yearn Finance Exploit Points to Dangers of Old Smart Contracts

Damage from the $11.6 million exploit appears contained to original version of DeFi protocol’s permissionless vaults

article-image

Source: Shutterstock / Ivan Babydov, modified by Blockworks

share

DeFi stalwart Yearn Finance was the target of a dizzyingly complex attack early Thursday that resulted in a roughly $11.6 million stablecoin haul for the culprit. 

But the root cause dates back over three years, to a version of the savings protocol that has long since been officially abandoned.

At least $8 million in stablecoins remains in the hacker’s control, most of which has been swapped to DAI, with the remaining millions exchanged for ether (ETH) and partially passed to crypto mixer Tornado Cash in an effort to obfuscate its origin.

Yearn’s YFI governance token initially fell by roughly 5% on the news, but remains up nearly 80% year-to-date, data from CoinGecko shows.

Yearn’s official Twitter confirmed the exploit, noting that the affected vault is “an immutable contract predating YFI, [that] was deprecated in 2020.”

The attacker was able to take advantage of a vulnerability in the deployment of one of the early Yearn vaults involving tether (USDT) deposits, which receive a Yearn-equivalent token yUSDT, according to security researchers Otter Sec, samczsun and Peckshield.

Using starting capital of just 10,000 USDT, the perpetrator was able to mint over 1.2 quadrillion yUSDT and then swap those for other stablecoins via Curve Finance to extract a total of $11.6 million.

Loading Tweet..

The attack vector is linked to an apparent oversight from February 2020, when the yUSDT token contract was deployed with a bug. 

Loading Tweet..

The detail identified by Samczsun regarding an apparent “misconfiguration” is notable, according to Ernesto Garcia, Smart Contract Engineer at OpenZeppelin.

“It seems weird to me that the Fulcrum iUSDC address is hard-coded,” Garcia told Blockworks. “If the contract went through a review, it was either an oversight (everyone assuming the correct address), or might’ve been changed before deployment as some tweets out there suggest.”

Garcia suggested that bytecode verification against the audited code from the time would determine whether there was any deliberate tampering.

Aside from the age of the bug, the execution of this attack required multiple steps, three different DeFi protocols, including Aave and a flash loan.

Diagram of the flow of funds; Source: Peckshield

Aave itself is unaffected, meaning its users are not at risk, according to Peckshield, nor are users of more recent Yearn vaults.

The unknown attacker converted $1.2 million USDT to 621 ETH, and used exploited TUSD stablecoin as collateral in Aave V2 to borrow a further 320 ETH ($640,000). Much of that ether has been deposited into the Tornado Cash 100 ETH anonymity set, blockchain records show.

A separate wallet linked to the first received over 4.7 million DAI and 2.5 million USDC, with the latter swapped to DAI, where it remains as of 9:30 am ET.

Hackers prefer DAI and ETH over USDC and USDT because the centralized stablecoins from Circle and Tether are more easily frozen, preventing further transfer.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates (3).png

Research

Pear Protocol has proven its market fit through its pair-trading infrastructure, sustaining consistent trading activity despite recent headwinds. Its strategic pivot toward Hyperliquid integration represents a major growth catalyst amid industry consolidation. While short-term token unlocks present challenges, current valuations and liquidity conditions may offer compelling opportunities for investors.

article-image

For just $54, you, too, could send a memecoin 500% higher

article-image

Memecoins, tech, and inflation have dominated the first half of the year

article-image

As the Trump administration continues to test Fed independence, markets are beginning to react

article-image

An Aave interest rate shock prompted over 475,000 validators to exit and pushed stETH into a prolonged depeg

article-image

While Roman Storm’s team is set to present its case, it’s not yet clear if the Tornado Cash founder will testify

article-image

A wireless network inspired by lost drones is now helping telco carriers reach your phone indoors