Scams

Yearn Finance reported a security breach on November 30 that resulted in approximately $9 million in losses. The attack targeted a vulnerability in a legacy yETH stableswap pool, allowing unauthorized token minting. Blockchain security firm PeckShield tracked roughly $3 million of the stolen funds to Tornado Cash, while the remaining $6 million remains in the exploiter's wallet.

Yearn Finance's yETH product suffered an exploit on November 30, 2025, enabling unlimited token minting that drained Balancer pools. Attackers extracted approximately 1,000 ETH valued at $3 million and transferred the funds through Tornado Cash, according to blockchain journalist Colin Wu. The platform confirmed its V2 and V3 Vaults remained unaffected and operational.

Yearn Finance confirmed an exploit targeting its yETH liquid staking token pool on November 30, 2025. An attacker exploited an infinite-mint vulnerability to drain millions in liquid staking tokens, routing approximately 1,000 ETH (around $3 million) to Tornado Cash. The protocol stated that Yearn Vaults V2 and V3 remain unaffected.

Yearn Finance's yETH vault suffered a security breach that resulted in approximately $3 million worth of ETH being stolen. The attacker exploited a smart contract vulnerability to mint excessive tokens and drain the liquidity pool. Other Yearn vaults remained unaffected, with V2 and V3 operations continuing normally.

Yearn Finance's yETH staking token was exploited on December 1, resulting in approximately $3 million in ETH losses. The attacker minted tokens without authorization and transferred 1,000 ETH to Tornado Cash. Yearn confirmed its V2 and V3 Vaults remain secure and unaffected by the breach.

Yearn Finance's yETH product was exploited, resulting in approximately $3 million worth of ETH transferred to Tornado Cash. The attacker minted an excessive amount of yETH tokens through a vulnerability, draining liquid staking tokens from the pool in a single transaction. Yearn confirmed the incident affected only the yETH LST stableswap pool, with Yearn Vaults remaining secure.

South Korean exchange Upbit will restore deposit and withdrawal services on December 1, 2025, at 1 PM KST following a November 27 security breach that resulted in $36.8 million in losses. The platform will absorb all losses from its own reserves, ensuring no impact to customer funds. Authorities suspect the Lazarus Group orchestrated the attack using compromised administrator credentials.

Democratic staff of the House Judiciary Committee released a 68-page report on November 24, 2025, alleging President Trump and family members built a cryptocurrency portfolio valued between $2.9 billion and $11.6 billion at 2025 peak prices. The document claims White House pardons and regulatory decisions directly benefited entities that invested in Trump-linked crypto projects. The family controls World Liberty Financial, which raised $550 million, and launched the $TRUMP memecoin that reached an $18 billion market cap.

A House Judiciary Committee staff report alleges President Donald Trump's cryptocurrency portfolio may be valued as high as $11.6 billion, with over $800 million in crypto asset sales income recorded in the first half of 2025. The document raises concerns about potential conflicts of interest stemming from holdings in World Liberty Financial and the TRUMP memecoin. The report suggests existing federal ethics frameworks may not adequately address structural conflicts created by these holdings.

South Korea's Upbit discovered a critical wallet software vulnerability while investigating a $30 million theft. The exchange identified a defect that could potentially expose private keys through blockchain data analysis. Upbit has suspended operations and pledged full reimbursement to affected users, though no direct link between the flaw and the November 26 breach has been confirmed.