Yearn Attack Messages Confirmed as Phishing Scheme by SlowMist

On December 1st, Yu Xian, founder of SlowMist, identified phishing attacks through fake ‘white hat negotiation’ messages on the blockchain following a Yearn attack, echoing previous Balancer use cases.

This incident underscores ongoing security vulnerabilities in DeFi, raising alerts over privacy protocols used in laundering activities and impacting trust among decentralized finance users.

Yearn Finance Attack Exposes Phishing Tactics in DeFi

Attacks mimicking “white hat negotiations” surfaced post-Yearn Finance incident. According to SlowMist’s Yu Xian, these were phishing attempts using previous Balancer incident tactics. Attackers utilized the Railgun privacy protocol for anonymity, transferring 1000 ETH via Tornado Cash.

The attackers’ address controls about $6 million worth of cryptocurrencies. SlowMist emphasizes the parallel with the Balancer incident, indicating premeditated strategic preparations and identity concealment by the attackers.

Yu Xian’s confirmation lacks formal institutional responses but underscores a heightened security alert across crypto networks. “The phishing attempt and detailed maneuvers on-chain should heighten community vigilance against similar threats.” — Yu Xian, Founder, SlowMist. No official responses from Yearn Finance or regulatory entities were present at the time of reporting.

DeFi Protocols Face Scrutiny as Ethereum Drops 5.88%

Did you know? Similar strategies used in the Balancer incident led to extensive scrutiny over privacy protocols like Tornado Cash, revealing vulnerabilities in DeFi ecosystems.

As of December 1st, 2025, Ethereum (ETH) stands at $2,815.25 with a market cap of $339.79 billion. Recent price data reflects a 24-hour decrease of 5.88% and a 60-day decrease of 35.87%. The circulating supply of ETH is 120,695,503 tokens.

Insights from the Coincu research team suggest potential regulatory tightening over DeFi protocols using privacy tools. Historical data indicates consistent challenges in tracking illicit uses of Tornado Cash, highlighting ongoing deficiencies in security frameworks.