Yearn Finance DAI Vault Exploit
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3SdMmR…QW7WSummary
On February 4, 2021, an attacker exploited Yearn Finance's v1 yDAI vault using a multi-protocol flash loan to manipulate exchange rates in Curve Finance's 3pool, causing approximately $11 million in vault losses while the attacker personally profited roughly $2.8 million. Yearn Finance's security team contained the exploit within eleven minutes, preserving $24 million of the vault's $35 million under management. Yearn subsequently reimbursed affected depositors by minting 9.7 million DAI against YFI collateral in a MakerDAO vault, with the intent to repay the debt from ongoing protocol revenue.
Connected Entities
5 entities · 60 linked investigations- Yearn Finance DAI Vault Exploit→mentioned with→Tether(70%)
- Cover Protocol→mentioned with→Yearn Finance(80%)
- Yearn Finance DAI Vault Exploit→mentioned with→Curve Finance(80%)
- Yearn Finance DAI Vault Exploit→mentioned with→Yearn Finance(80%)
- Yearn Finance→mentioned with→Curve Finance(80%)
- Yearn Finance DAI Vault Exploit→mentioned with→Cover Protocol(80%)
Connected Through
4 shared actors · 187 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Tetherorganization
- ⌂Curve Financeprotocol
- ⌂Yearn Financeprotocol
- ⌂Cover Protocolprotocol
Timeline(8 events)
24 July 2020
Quantstamp completes security review of Yearn.Finance v1 smart contracts.
Quantstamp Blog5 November 2020
MixBytes completes audit of Yearn.Finance protocol v1 smart contracts, finding no critical or major issues.
MixBytes Audits — GitHub4 February 2021
Attacker begins exploit of yDAI v1 vault using flash loans from dYdX and Aave v2, borrowing against Compound to manipulate Curve 3pool exchange rates. The attack repeats across 11 transactions over approximately 38 minutes.
Yearn Finance Security Disclosure — GitHub4 February 2021
Yearn security team responds within 11 minutes of detecting the attack, applying setMin(0) to DAI, USDC, USDT, and TUSD v1 vaults, halting further exploit cycles. Total vault loss: approximately $11 million. Attacker profit: approximately $2.8 million. Protected: approximately $24 million.
CoinDesk5 February 2021
Yearn Finance publishes detailed post-mortem identifying three root causes: 1% slippage tolerance, 0% withdrawal fee, and unrestricted earn() access.
Yearn Finance Security Disclosure — GitHub8 February 2021
Yearn announces plan to make vault depositors whole by opening a MakerDAO CDP with YFI treasury collateral to mint 9.7 million DAI, restoring the vault's net asset value.
The Defiant8 February 2021
Nexus Mutual begins processing 18 insurance claims related to the yDAI hack. Ultimately 15 are approved for a total payout of approximately $2.317 million.
Nexus Mutual DocumentationDecision Log
- slot 426514580 · hash 9n3eEVCGtMwTHFbPFK8EtBQA1MS83MTXjYxKF5xUdFnJ
- slot 426514575 · hash 2PAubRjwAKiw2MLe1a5UzRvT7b3AHo2CGEwAJLc13WRt
- slot 425568688 · hash DTXcoCzGJdoEZYqouxktNerBiFT6yF3PbWCLhv7LauMh
- slot 425568685 · hash 2godFJ2hUK3LwozYtA8EjQRkhJfWdSwLMpR5mxDvCGny
- slot 423324688 · hash FTXLssoBtEcy6jwSvWdSHr6hPJUxPnnYsZt12wpaAfiU
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 13 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/31/2026, 7:00:24 AM
last updated: 5/31/2026, 7:00:24 AM
3 viewsavoid.net — verified advice for a post-truth world