Complete Review of Yearn’s $9 Million Hack: How a Three-Stage Bug Triggered "Infinite Minting"

[Bitpush] Last week’s yETH attack on Yearn Finance has finally gotten a full post-mortem report from the official team.

In short, they had an old stableswap pool with a hidden three-stage numerical bug—attackers exploited it to “mint unlimited LP tokens,” draining nearly $9 million directly from the pool. The incident happened on November 30, specifically at block height 23914086.

But there’s some good news. Yearn, together with the Plume and Dinero teams, managed to recover 857.49 pxETH, about a quarter of the stolen assets. This amount will be proportionally returned to yETH deposit users.

On the technical side, the attacker’s method was quite sophisticated—using a series of complex operations to push the pool’s internal parser into a divergent state, eventually triggering an arithmetic underflow. The main target was a custom stableswap pool aggregating various LSTs, plus a yETH/WETH Curve pool. The team specifically emphasized: v2 and v3 vaults and other products were unaffected.

A fix is already on the way: adding explicit domain checks to the parser, replacing all critical unsafe arithmetic with checked versions, and a clever move—disabling the bootstrap logic immediately after the pool goes live. This incident is a costly lesson learned with real money.