Yearn Finance Exploit Points to Dangers of Old Smart Contracts

Damage from the $11.6 million exploit appears contained to original version of DeFi protocol’s permissionless vaults

article-image

Source: Shutterstock / Ivan Babydov, modified by Blockworks

share

DeFi stalwart Yearn Finance was the target of a dizzyingly complex attack early Thursday that resulted in a roughly $11.6 million stablecoin haul for the culprit. 

But the root cause dates back over three years, to a version of the savings protocol that has long since been officially abandoned.

At least $8 million in stablecoins remains in the hacker’s control, most of which has been swapped to DAI, with the remaining millions exchanged for ether (ETH) and partially passed to crypto mixer Tornado Cash in an effort to obfuscate its origin.

Yearn’s YFI governance token initially fell by roughly 5% on the news, but remains up nearly 80% year-to-date, data from CoinGecko shows.

Yearn’s official Twitter confirmed the exploit, noting that the affected vault is “an immutable contract predating YFI, [that] was deprecated in 2020.”

The attacker was able to take advantage of a vulnerability in the deployment of one of the early Yearn vaults involving tether (USDT) deposits, which receive a Yearn-equivalent token yUSDT, according to security researchers Otter Sec, samczsun and Peckshield.

Using starting capital of just 10,000 USDT, the perpetrator was able to mint over 1.2 quadrillion yUSDT and then swap those for other stablecoins via Curve Finance to extract a total of $11.6 million.

Loading Tweet..

The attack vector is linked to an apparent oversight from February 2020, when the yUSDT token contract was deployed with a bug. 

Loading Tweet..

The detail identified by Samczsun regarding an apparent “misconfiguration” is notable, according to Ernesto Garcia, Smart Contract Engineer at OpenZeppelin.

“It seems weird to me that the Fulcrum iUSDC address is hard-coded,” Garcia told Blockworks. “If the contract went through a review, it was either an oversight (everyone assuming the correct address), or might’ve been changed before deployment as some tweets out there suggest.”

Garcia suggested that bytecode verification against the audited code from the time would determine whether there was any deliberate tampering.

Aside from the age of the bug, the execution of this attack required multiple steps, three different DeFi protocols, including Aave and a flash loan.

Diagram of the flow of funds; Source: Peckshield

Aave itself is unaffected, meaning its users are not at risk, according to Peckshield, nor are users of more recent Yearn vaults.

The unknown attacker converted $1.2 million USDT to 621 ETH, and used exploited TUSD stablecoin as collateral in Aave V2 to borrow a further 320 ETH ($640,000). Much of that ether has been deposited into the Tornado Cash 100 ETH anonymity set, blockchain records show.

A separate wallet linked to the first received over 4.7 million DAI and 2.5 million USDC, with the latter swapped to DAI, where it remains as of 9:30 am ET.

Hackers prefer DAI and ETH over USDC and USDT because the centralized stablecoins from Circle and Tether are more easily frozen, preventing further transfer.


Get the news in your inbox. Explore Blockworks newsletters:

  • Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
  • Empire: Start your morning with the top news and analysis to inform your day in crypto.
  • Forward Guidance: Reporting and analysis on the growing intersection of crypto and macroeconomics, policy and finance.
  • 0xResearch: Alpha directly in your inbox. Market highlights, data, degen trade ideas, governance updates, token performance and more.
  • Lightspeed: Built for Solana investors, developers and community members. The latest from one of crypto’s hottest networks.
  • The Drop: For crypto collectors and traders, covering apps, games, memes and more.
  • Supply Shock: Tracking Bitcoin’s rise from internet plaything worth less than a penny to global phenomenon disrupting money as we know it.
Tags

Upcoming Events

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research

article-image

Institutional players are energized by huge market shifts, “the scale of which you haven’t even imagined”

article-image

A memecoin short squeeze pushed Hyperliquid to the brink — and revealed decentralization limits

article-image

Tools for Humanity’s Developer Reward pilot program kicks off on April 1

article-image

Blockworks Research analyst Boccaccio explains the HyperLiquid controversy and why they need to adjust risk and margin

article-image

What Grayscale’s watching going into the second quarter and why crypto had a rough start to the year

article-image

Sol’s price drop was partially triggered by one of the year’s more chaotic memecoin events