The $9M yETH Exploit: How 16 Wei Became Infinite Tokens

On November 30, 2025, an attacker exploited a cached-storage vulnerability in Yearn Finance’s yETH pool by poisoning packed_vbs[] virtual-balance cache via repeated deposit/withdraw cycles, draining ~ $9M after minting 235 septillion yETH from a 16-wei deposit. The attack relied on flash loans to acquire capital, leveraged an edge-case where cached virtual balances were not reset when supply hit zero, swapped minted tokens for ETH across DEXes, repaid loans, and laundered proceeds (partly via Tornado Cash); the report recommends explicit state resets, transaction simulation, and runtime protections to prevent similar incidents.