Yearn Finance Recovers 857 pxETH From $9 Million yETH Exploit, Outlines Comprehensive Asset Recovery and Security Enhancement Strategy

Yearn Finance has published an in-depth technical analysis of the yETH vulnerability that resulted in approximately $9 million in stolen assets, revealing that recovery efforts are already underway. With support from asset recovery services provided by the Plume and Dinero teams, the protocol has successfully retrieved 857.49 pxETH, representing roughly one-quarter of the compromised funds. These recovered assets will be proportionally returned to affected yETH depositors.

The Vulnerability Mechanism: A Multi-Layered Arithmetic Flaw

The exploit, which occurred at block 23,914,086 on November 30, 2025, exploited a multi-layered arithmetic flaw embedded in Yearn’s legacy stableswap liquidity pool. The attack centered on a sophisticated vulnerability within the pool’s internal parser, which aggregates multiple liquid staking tokens (LSTs). By executing a complex chain of operations, the attacker forced the parser into an inconsistent accounting state, ultimately triggering an arithmetic underflow that allowed unbounded LP token generation. This same vulnerability extended to interactions with the yETH/WETH Curve pool, amplifying the attack’s impact.

Immediate Asset Recovery Impact

The asset recovery services deployed by the Plume and Dinero teams have proven instrumental in mitigating the damage. The successful recovery of 857.49 pxETH demonstrates the effectiveness of coordinated efforts in DeFi security incidents. Yearn’s commitment to proportional fund distribution ensures that depositors will receive compensation based on their exposure to the compromised pool.

Scope of Impact and Unaffected Systems

Critically, Yearn confirmed that its v2 and v3 vaults, along with other core products, remained secure and unaffected by the exploit. The vulnerability was isolated to the custom stableswap pool, preventing a systemic collapse across the protocol’s ecosystem.

Remediation and Security Hardening Plan

To prevent similar incidents, Yearn has implemented a comprehensive remediation strategy. Key measures include:

• Parser Validation: Implementing explicit domain checks within the pool’s internal parser to prevent inconsistent states
• Arithmetic Safety: Replacing unsafe arithmetic operations with checked arithmetic in all critical sections
• Bootstrap Deactivation: Disabling bootstrap logic after pool initialization to eliminate post-launch vulnerability windows

These updates represent a fundamental shift toward defense-in-depth architecture, ensuring that future iterations of Yearn’s liquidity pools incorporate multi-layered safeguards against arithmetic manipulation and parsing exploits.