Yearn Finance successfully recovered $2.4 million after the attack, but the hacker transferred the funds to Tornado Cash
The Yearn Finance team achieved its first victory in the race to recover assets, successfully tracking and reclaiming $2.4 million of an estimated total loss of nearly $9 million. The attack stemmed from a computational vulnerability that allowed the hacker to mint almost unlimited amounts of yETH, which were then used to extract liquidity from Curve's yETH stable swap and yETH-WETH pool. $YFI
Despite the initial recovery success, the complex "rescue" operation faces significant obstacles. Reports confirm that the attacker quickly transferred at least 1,000 ETH and an undisclosed amount of liquid-staked tokens to the notorious mixer Tornado Cash. The use of this anonymous tool severely complicates the follow-up tracking and recovery of the remaining stolen funds. This incident marks the third security vulnerability targeting Yearn since 2021, comparable in complexity to the recent Balancer hack. $ETH
