Dinero

when

Plume

Tornado

<p>Yearn Finance has taken its first major step toward repairing the damage from its recent yETH exploit after securing a partial recovery.</p>
<div id="cn-block-summary-block_26cf1506111738e8ad6ac86a8a0e9a25" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">
  <span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Yearn Finance recovered $2.4M from the $9M yETH exploit through a coordinated effort with Plume and Dinero.</li>
   <li>The recovery covers assets still held by the attacker, while the laundered ETH remains out of reach.</li>
   <li>A full post-mortem is underway as Yearn prepares further steps to return remaining funds to affected users.</li>
  </ul>
 </div>
</div>
<p>Yearn Finance has recovered $2.4 million from the $9 million yETH exploit that hit the protocol at the end of November.</p>
<p>The update came late on Dec. 1, when Yearn <a href="https://x.com/yearnfi/status/1995488425785659492?s=46&amp;t=nznXkss3debX8JIhNzHmzw" target="_blank" rel="noopener noreferrer nofollow">confirmed</a> that 857.49 pxETH had been recovered through a coordinated effort with Plume and Dinero, and that all retrieved funds will be returned to affected users.</p>
<h2 class="wp-block-heading" id="the-exploit-that-hit-yearn-s-legacy-yeth-pool">The exploit that hit Yearn’s legacy yETH pool</h2>
<p>The <a href="https://crypto.news/yearn-finance-yeth-exploit-3m-sent-tornado-cash-2025/" target="_blank" rel="noopener noreferrer nofollow">incident</a> took place at 21:11 UTC on Nov. 30 and targeted Yearn’s legacy yETH stableswap pool, a contract powered by custom code rather than the standard Curve (<a href="https://crypto.news/price/curve-dao/" target="_blank" rel="noopener noreferrer nofollow">CRV</a>) implementation.</p>
<p>A subtle arithmetic flaw allowed the attacker to mint an enormous amount of yETH in one transaction, which they then used to drain assets from the affected pools. Roughly $8 million was taken from the yETH stableswap pool and another $900,000 from the yETH-WETH pool on Curve.</p>
<p>You might also like: <a href="https://crypto.news/balancer-repay-liquidity-providers-8m-v2-exploit-2025/" rel="noopener noreferrer nofollow"> Balancer to repay liquidity providers $8M in recovered funds after $128M v2 exploit </a></p>
<p>No other Yearn product used this contract, and V2 and V3 vaults, which hold more than $600 million, were not touched. Engineers from Yearn, SEAL 911, and ChainSecurity entered a war-room immediately after the breach, and a full post-mortem is underway.</p>
<p>Part of the stolen Ethereum (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noopener noreferrer nofollow">ETH</a>) was quickly laundered through Tornado Cash, limiting the chances of full recovery, but several LST assets tied to the attacker’s wallets were still traceable during the window that followed the exploit. That is where Yearn focused its efforts.</p>
<h2 class="wp-block-heading" id="how-yearn-recovered-2-4m-and-what-happens-next">How Yearn recovered $2.4M and what happens next</h2>
<p>The pxETH recovered in the latest update was still within the attacker’s reach and had not been mixed or converted. Working with Plume and Dinero, Yearn neutralized the exploiter’s pxETH positions and redirected equivalent value back to the protocol.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>yETH update: With the assistance of the Plume and Dinero teams, a coordinated recovery of 857.49 pxETH ($2.39m) was performed. Recovery efforts remain active and ongoing. Any assets successfully recovered will be returned to affected depositors.<a rel="noopener noreferrer nofollow" href="https://t.co/xaClNhd0C0">https://t.co/xaClNhd0C0</a></p>— yearn (@yearnfi) <a href="https://twitter.com/yearnfi/status/1995488425785659492?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">December 1, 2025</a>
  </blockquote>
 </div>
</figure>
<p>This will allow affected depositors to be compensated without waiting for courtroom processes or lengthy negotiations. The team said recovery efforts are still active and that additional assets may follow if on-chain options allow it.</p>
<p>Users who were impacted can request support through Yearn’s Discord while the investigation continues. The protocol has also reiterated that none of its other products share this code path and that old contracts are being reviewed to prevent similar issues.</p>
<p>The quick communication has helped steady sentiment around Yearn’s ecosystem, especially after YFI’s sharp drop following the attack. The token later pared some losses as details of the recovery were made public.&nbsp;</p>
<p>Yearn is expected to release its full post-mortem once the audit partners finalize their review, and the team has already pointed users to its documentation outlining its vulnerability disclosure framework and audit history.</p>
<p>Read more: <a href="https://crypto.news/cardano-network-splits-after-software-exploit-triggers-fork/" rel="noopener noreferrer nofollow"> Cardano network splits after software exploit triggers fork </a></p>

Yearn Finance recovers $2.4M following $9M yETH exploit

Table of Contents

crypto.news

Other articles published on Dec 2, 2025

Join our free newsletter for daily crypto updates!