A Sophisticated Exploit Targeting Ethereum Derivatives
yETH represents an index token composed of multiple liquid versions of ETH, essentially liquid staking tokens or LSTs. This structure allows users to gain diversified exposure to various Ethereum liquid staking protocols. X user Togbe was the first to report massive and abnormal transactions involving several LSTs, notably those from Yearn, Rocket Pool, Origin, and Dinero.
Technical analysis of the exploit reveals meticulous preparation. The attackers deployed several new smart contracts specifically designed for this operation. These contracts self-destructed immediately after the transaction execution, thereby erasing evidence and significantly complicating post-mortem analysis. This self-destruction technique has become a signature of the most advanced DeFi hacks, allowing hackers to cover their tracks.
Before the attack, the yETH pool displayed a TVL of approximately $11 million according to Dexscreener. Total financial losses remain unclear, but the impact far exceeds the $3 million directly pocketed by the hackers. The pool’s collapse created a major imbalance in the LST ecosystem, temporarily affecting the prices and liquidity of several related protocols.
DeFi Security Still Under Pressure
This incident revives concerns regarding DeFi protocol security, particularly those using legacy contracts. The crypto community has reacted with mixed feelings, with some developers pointing fingers at the continued use of obsolete smart contracts that haven’t benefited from the latest security updates. This criticism isn’t new for Yearn Finance, which has already experienced several security incidents.
In 2021, Yearn suffered a hack affecting its yDAI vault, resulting in a total loss of $11 million, of which $2.8 million was actually stolen by hackers. More recently, in December 2023, a faulty script wiped out 63% of a position in the protocol’s treasury, demonstrating that risks don’t only come from external attackers but also from internal errors.
The general context of DeFi security in November 2024 proves particularly concerning. According to CertiK, the crypto industry lost approximately $127 million due to hacks and exploits during that month alone. This figure would have reached $172 million without the recovery of $45 million in stolen funds. The attack against Balancer dominates this ranking with over $116 million lost in a sophisticated cross-chain exploitation, marking one of the year’s most significant DeFi security breaches.
On the same topic:
