On February 4, 2021, attacker used flashloans to acquire 215,000 ETH, then deposited borrowed USDC/DAI into Yearn's yDAI vault at manipulated exchange rates without sufficient slippage protection. The vault lost $11M; attacker profited ~$2.7M after $3.5M in fees.