Yeon Finance suffers attack exploiting unlimited yETH minting vulnerability… $9 million total loss
Summary
- Yeon Finance reported it suffered approximately $9 million in losses from an attack targeting the yETH liquidity pool.
- The attacker depleted the pool's assets by minting yETH tokens at a virtually infinite level, and moved some assets to Tornado Cash.
- The incident has again raised concerns about DeFi security vulnerabilities.
The Ethereum (ETH)-based DeFi protocol Yeon Finance (YFI) suffered losses of about $9 million from an attack targeting the yETH liquidity pool.
On the 1st (local time), according to PeckShield, the Yeon Finance exploit attacker minted virtually 'infinite' yETH tokens in a single transaction, draining the pool's assets at once.
In the process, about 1000 ETH (approximately $3 million) was sent to Tornado Cash, and the attacker address (0xa80d…c822) is currently understood to hold about $6 million worth of crypto assets.
The incident is analyzed as an exploitation of a vulnerability targeting several Ethereum-based LST (liquid staking tokens) contained in the yETH pool. Yeon Finance stated that "V2 and V3 vaults were not affected," but the attack has renewed concerns about security vulnerabilities across DeFi as a whole.
Suehyeon Lee
shlee@bloomingbit.ioI'm reporter Suehyeon Lee, your Web3 Moderator.
