← Yearn Financereviewed 2026-10-16 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Yearn Finance against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: February 2021 DAI Vault Exploit (~$11M)
“A second, smaller exploit of a legacy iearn vault occurred within the same month.”
reviewerA second, smaller exploit of a legacy iearn vault occurred in February 2021, within the same month as the yDAI exploitNo independent source documents a second iearn vault exploit in February 2021. The cited thedefiant.io article is actually about the December 2025 TUSD vault hack (already covered in this page's 'December 2025 yETH Pool Exploit' section), which was the second attack in that month, not February 2021. This appears to be a miscitation that duplicates a real 2025 event as a fabricated 2021 one. Recommend deleting the sentence. - #2[disputed][awaiting moderator]in the timeline
“A second exploit targets the legacy Yearn iearn vault within the same month, compounding concerns over undecommissioned legacy contracts.”
reviewerA second exploit targeted the legacy Yearn iearn vault on approximately February 13, 2021, within the same month as the yDAI hackThis entire timeline entry (dated 2021-02-13) appears to be fabricated from a miscited 2025 article and duplicates the real December 17, 2025 TUSD vault hack already recorded at timeline[12]. Recommend removing this timeline entry entirely rather than editing its date, since no corresponding real event exists at this date.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: Protocol Overview
“At its peak in 2021, the protocol held over $6 billion in total value locked.”
reviewerAt its peak in 2021, Yearn Finance held over $6 billion in total value locked (TVL)Could not find a credible contemporaneous source confirming a $6 billion TVL peak specifically; the best-documented figures top out around $4-5 billion in 2021 DeFi-tracker reporting, with Yearn's own newsletter hinting at a higher earlier peak. Not enough to confirm or dispute; genuinely unverifiable with the sources available.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in section: Protocol Overview
“Governance is handled by holders of the YFI token, with binding proposals executed by a 6-of-9 multisignature wallet.”
reviewerYearn's governance is executed by a 6-of-9 multisignature wallet, and the protocol entered ecosystem alliances with Cream Finance, Keep3r Network, and SushiThe underlying claim (6-of-9 multisig) is true and independently verified via Yearn's own documentation, as are the Cream/Keep3r/Sushi alliances (verified via contemporaneous reporting). However, neither of the two sources actually cited in this section supports these specific facts -- gemini.com describes a different (token-vote) governance model and messari.io could not be accessed. The citation should point to a source that actually backs the claim.
confirmed
8 claimsThe cited evidence supports the claim as written.
- #5[confirmed][no action needed]in section: February 2021 DAI Vault Exploit (~$11M)
“The vault suffered approximately $11 million in losses, though the attacker's net profit was approximately $2.8 million.”
reviewerThe February 2021 yDAI vault exploit caused approximately $11 million in vault losses, with the attacker netting approximately $2.8 million, due to 1% slippage tolerance, a zeroed withdrawal fee, and an unprotected earn() function; Yearn's team responded within 11 minutes and protected $24 million; Yearn later minted 9.7 million DAI via a MakerDAO vault to make depositors wholeFigures and mechanism are well corroborated by contemporaneous reporting. - #6[confirmed][no action needed]in section: CREAM Finance Affiliation and October 2021 $130M Hack
“In October 2021, Cream Finance suffered its third security breach of the year, with attackers extracting approximately $130 million via a flash loan exploit.”
reviewerIn October 2021, Cream Finance suffered its third hack of the year, losing approximately $130 million via a flash loan exploit connected to Yearn's yUSD/4-Curve tokens, which inflated the oracle-reported value of crYUSDDollar figure, timing, and technical mechanism are well corroborated. The cited medium.com URL returned a 403 on direct fetch (likely bot-blocking, not dead -- it has a successful Wayback archive from July 2026) and the same analysis is independently mirrored on immunefi.com. - #7[confirmed][no action needed]in section: Iron Bank Bad Debt Dispute
“In March 2023, Iron Bank unilaterally and without prior notice modified its smart contracts to freeze Alpha Homora's lending accounts.”
reviewerAlpha Homora's February 2021 Iron Bank exploit caused ~$37M in losses; it agreed to repay via 20% fee diversion and 50M ALPHA tokens (worth ~$109M at the time); collateral fell to ~$6M against ~$32M remaining debt by 2023; Iron Bank froze Alpha Homora's accounts in March 2023 without prior noticeAll figures and the sequence of events are corroborated across two independent outlets; this URL loaded fine despite having no Wayback archive recorded. - #8[confirmed][no action needed]in section: December 2023 Treasury Script Error ($1.4M Loss)
“the tokens worth approximately $2.28 million were sold for only approximately $779,958 in yvDAI—a loss of roughly 63% due to slippage”
reviewerOn December 11, 2023, a faulty multisig script swapped Yearn's entire 3,794,894 lp-yCRVv2 token balance (instead of only earned fees) for approximately $779,958 in yvDAI, realizing a loss of roughly 63% due to slippage; only one wallet returned funds (~2 ETH); no user funds were affectedAll figures check out against Yearn's primary disclosure once the yvDAI token count is correctly understood as a token quantity, not a 1:1 dollar figure. - #9[confirmed][no action needed]in section: December 2025 yETH Pool Exploit ($9M)
“The attacker deposited only 16 wei yet was able to mint approximately 235 septillion yETH LP tokens by exploiting a flaw in the pool's cached virtual balance system (packed_vbs[]).”
reviewerOn November 30, 2025, an attacker deposited 16 wei into Yearn's yETH pool to mint ~235 septillion yETH LP tokens by exploiting a stale packed_vbs[] cache, draining ~$9 million; a war room convened ~20 minutes after the exploit; 1,000 ETH was sent to Tornado Cash within hours, with the remainder laundered by December 5; 857.49 pxETH was later recovered in coordination with Plume and DineroMechanism, figures, and recovery details are corroborated across Check Point Research, The Block, and QuillAudits. - #10[confirmed][no action needed]in section: December 2025 yETH Pool Exploit ($9M)
“Approximately two weeks later on December 17, 2025, a fourth exploit drained roughly $300,000 from a legacy Yearn v1 TUSD vault via a donation attack against a misconfigured Fulcrum sUSD strategy.”
reviewerApproximately two weeks later, on December 17, 2025, a fourth exploit drained roughly $300,000 from a legacy Yearn v1 TUSD vault via a donation attack against a misconfigured Fulcrum sUSD strategyThis is the real event that the fabricated 'February 2021 second exploit' claim (see separate finding, defect_group yearn-fake-feb-2021-second-exploit) appears to duplicate. - #11[confirmed][no action needed]in section: Founder Departure and SEC Investigation
“Andre Cronje and Anton Nell publicly announced their departure from the DeFi space, causing YFI to drop approximately 13-14% in a single day.”
reviewerAndre Cronje and Anton Nell announced their departure from DeFi in March 2022, causing YFI to drop approximately 13-14% in a single day; the SEC began inquiring about Yearn in 2021, first about token sales/fundraising, later about whether vaults were investment contracts; no formal SEC enforcement action has been publicly confirmedReported price-drop percentages vary 9-14% across outlets depending on measurement window; 13-14% is within the reported range (Decrypt, Cryptoast) though on the high side. The SEC claims are properly hedged as Cronje's own account throughout the section. - #12[confirmed][no action needed]in section: Governance and Centralization Concerns
“In February 2021, a governance vote passed to inflate the YFI supply by 20%, triggering community controversy.”
reviewerIn February 2021, a governance vote passed to mint 6,666 additional YFI tokens, approximately 20% supply inflationMinor rounding (22% vs 20%) traceable directly to the cited source's own headline; not treated as a substantive error.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.