Yearn Finance

Yearn began in early 2020 as Andre Cronje's tool for moving stablecoins to whichever lending protocol paid most. In July 2020 he released YFI by distributing it to users: 30,000 tokens went to liquidity providers over about a week, and minting control passed from Cronje to a multisig shortly after. Supply was later fixed at 36,666 YFI (YFI docs). Today the project is run by contributor teams funded by the DAO and governed by YFI holders.

The product is the vault: deposit one token, receive a vault share (a yvToken), and strategies put the underlying to work. You are paid in the same token you deposited. Yearn also runs curated vaults on other platforms, liquid lockers such as yCRV, and experiments that sit outside the core vaults; the yETH pool exploited in 2025 was one of those.

In V3, each vault can hold several strategies, and a separate Accountant contract sets its management and performance fees. Yearn's treasury then takes a protocol share of those fees, configurable from 0% to 50%. The docs' worked example: a vault earns 100, charges a 20% performance fee (20), and Yearn takes 10% of that (2) while the vault manager keeps 18 (protocol fees). The APY shown in the app is after fees.

Every strategy gets a risk score. Six measures cover the strategy itself (review, test coverage, code size, loss scenarios, privileged roles, number of integrations) and five cover each external protocol it touches (audits, centralisation, TVL, age, type). The sum maps to a level from 1 (lowest) to 4, and a multi-strategy vault takes the highest level of any strategy in it. On the protocol side, an integration with more than $480 million in TVL scores best and one under $10 million worst; a protocol live for 24 months or more scores best on age (risk score).

A USDC vault's rate is the blended rate of its strategies minus fees; it changes daily. Rates on Yearn are rarely the highest on a given day, because the higher-yield venues usually score worse.

On 30 November 2025 (disclosed 1 December) an attacker broke the yETH weighted stableswap pool, a basket of eight liquid staking tokens. They pushed the pool's solver into an invalid state, over-minted yETH, drained the pool, then re-entered its initialisation path and minted about 2.35 × 10⁵⁶ yETH to empty the yETH/ETH Curve pool as well (disclosure). DefiLlama puts the loss at about $9 million. 857.49 pxETH was recovered with help from the Plume and Dinero teams; the rest went through Tornado Cash.

Yearn's position is that yETH is governed by its own depositors and, under YIP-72's "use at own risk" clause, Yearn contributors are not liable to reimburse. Recovered assets go back to yETH depositors. V2 and V3 vaults were not affected.

The common thread: losses came from legacy or side products (v1 vaults, iearn tokens, yETH), not from the V2/V3 vault contracts that hold most deposits today.

DefiLlama counted about $204.5 million in Yearn on 27 September 2026, 3% of the $6.9 billion peak in December 2021 (DefiLlama). Ethereum holds almost all of it; the second-largest deployment is Katana, at about $18 million.

• Governance: veYFI, the lock-based system, is deprecated. YFI holders now stake into stYFI (vote themselves) or stYFIx (delegate), paid in yvUSDC with a 14-day unstaking cooldown.
• Products: V3 multi-strategy vaults, curated vaults run for other platforms, and yBOLD-family stability-pool vaults, which were re-engineered after the November 2025 yUSND loss.
• Security: yETH recovery efforts were still described as ongoing in the last disclosure.