The $9M yETH Exploit: How 16 Wei Became Infinite Tokens

According to Check Point Research, on 30 November 2025 a critical exploit targeted Yearn Finance’s yETH pool on Ethereum, and within hours about $9 million was stolen from the protocol. The attacker minted an astronomical number of tokens—235 septillion yETH (a 41-digit figure)—while depositing only 16 wei, worth approximately $0.000000000000000045.

The attack stemmed from a cached storage flaw in the pool’s internal accounting: the yETH pool stores virtual balances in packed_vbs[] to save gas, and after the pool was emptied the main supply counter reset to zero but the cached values were never cleared. The exploit unfolded across multiple stages, including deposit-and-withdrawal cycles to poison the cached balances, draining the pool, and then a final deposit of minimal wei that triggered the initial-deposit logic, causing trillions of LP tokens to be minted.

The incident underlines the need for explicit state management in DeFi, as a single edge-case reset failure allowed the attacker to gain control over the entire pool and extract funds.