Yearn's yETH Stable Pool Loses $8.9M in Custom Contract Attack

Yearn's yETH stable pool suffered an $8.9 million loss on Nov. 30 at 21:11 UTC through mass minting via a custom contract, Yearn said Dec. 1. The attack drained approximately $8 million from the stable pool and $900,000 from the yETH-WETH pool on Curve. The compromised code was isolated to the yETH product, with V2 and V3 Vaults unaffected. Yearn noted the attack's complexity resembles a previous Balancer incident and is working with SEAL911 and auditor ChainSecurity on the investigation.