Yearn Finance's legacy pool vulnerability, $9 million loss, partial recovery underway

Yearn Finance has recently disclosed a critical security flaw found in its legacy stable swap liquidity pool. The core issue was a numerical error that allowed attackers to generate unlimited LP tokens, creating a vulnerability.

Scope and Mechanism of the Attack

This hacking resulted in the theft of approximately $9 million worth of assets. The attack occurred on November 30, 2025, and malicious actors exploited the bug to issue unlimited liquidity provider tokens, thereby siphoning assets from the pool.

Yearn Finance’s Immediate Response

The project team responded swiftly and successfully recovered 857.49 pxETH. The recovered assets will be returned to the liquidity providers affected by this incident. Yearn Finance emphasized that this process is a crucial step in restoring user trust.

Ensuring Safety of Other Pools

Importantly, this vulnerability did not affect v2 and v3 vaults. Yearn Finance clearly stated that the security of its core vault systems currently in operation remains intact.

Future Security Enhancement Plans

To prevent recurrence, Yearn Finance has decided to implement a domain verification mechanism. This is expected to help detect and prevent similar vulnerabilities caused by numerical errors in the future.