crypto.news
The popular decentralized finance (DeFi) platform, Yearn Finance, was recently hacked using the open-source liquidity protocol, Aave. Per the on-chain data, the hacker has already moved more than $11.5 million in stablecoins.
According to the on-chain data, the exploiter used Aave V1 to get 3.02 million DAI, 2.57 million USDC, 1.78 million BUSD, 1.51 million TUSD and 1.19 million USDT, among other assets, from Yearn Finance. The hacker used Tornado Cash to remove tracks of the stolen funds.
Moreover, the blockchain security firm PeckShield noted that the “root cause” of the exploit was not Aave, but rather the “misconfigured” yUSDT — Yearn Finance’s USDT mirror. Per the tweet, the hacker minted 1.2 quadrillion yUSDT coins, using only $10,000 USDT, swapping the glitchy tokens with “other stablecoins.”
It appears the root cause is due to the misconfigured yUSDT, which is exploited to mint huge yUSDT (1,252,660,242,212,927.5) from a small $10K USDT. The huge yUSDT is then cashed out by swapping to other stable coins. https://t.co/Qz3vwtbcot pic.twitter.com/xlsc2Nlmle
— PeckShield Inc. (@peckshield) April 13, 2023
According to the pseudonymous security researcher and Yearn Finance contributor, Storming0x, the hacker used the “iearn legacy protocol,” which was launched in 2020.
We are aware of an issue that seems isolated to the iearn legacy protocol launched in 2020 and liquidity pool.
— Storm Blessed 0x 🇯🇵 (@storming0x) April 13, 2023
Yearn v2 vaults seem not to be impacted.
Yearn contributors are investigating.
Further comms to follow on main account. https://t.co/CKddWwjFj8
Blockchain security company OtterSec states that the hacker repaid some USDT loans on Aave and then “rebalanced the yUSDT token.” Furthermore, the exploiter used Curve’s y Swap to acquire real stablecoins using the misconfigured yUSDT.
Diving through the trace, it appears the attackers did a couple key steps.
— OtterSec (@osec_io) April 13, 2023
1. Repay a number of Aave USDT loans
2. Rebalance the yUSDT token (which attempts to withdraw from the incorrect Fulcrum iUSDC token)
3. Invoke Curve y Swap with largely imbalanced share prices pic.twitter.com/BFsnlewDrl