Leaderboard
193All-time rank
Yearn Finance
Feb 5, 2021
$11.0M
Lost
$11.0M
Recovered
$0
Net loss
$11.0M
Unrecovered0% recovered
On February 4, 2021, attacker used flashloans to acquire 215,000 ETH, then deposited borrowed USDC/DAI into Yearn's yDAI vault at manipulated exchange rates without sufficient slippage protection. 5M in fees.
How the exploit worked
View reproducible PoCSlippage proection absent.
Lost: 11 Million $
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Feb 5, 2021Exploit executed — $11.0M drained via spot price manipulation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)