Yearn Finance's yETH LST stableswap pool has suffered a critical exploit resulting in a total loss of approximately $8.9 million to $9 million. Security firm PeckShield confirmed that the attack vector involved minting a near-infinite number of yETH tokens, which allowed the attacker to drain the liquidity. The attacker has reportedly begun laundering funds via Tornado Cash. BlockSec Phalcon detected the attack, noting it involved an "infinite mint" vulnerability within a custom version of the stableswap code. The incident occurred on November 30. The Yearn Finance team has clarified that this issue is isolated to this specific custom pool and is unrelated to other Yearn products. Core Yearn V2 and V3 vaults remain safe and unaffected. [Update 1] Additional reports confirm that BlockSec Phalcon identified the root cause as an "infinite mint" bug in the custom stableswap code. The project has reiterated that the vulnerability is strictly contained within this specific yETH pool, and main vaults (V2/V3) are not at risk.