On April 13, 2023, Yearn Finance's yUSDT vault was exploited through a misconfigured oracle reference pointing to Fulcrum's USDC contract instead of USDT. Attacker exploited the incorrect contract pointer to manipulate share prices, minting 1.2 quadrillion yUSDT by depositing only 10,000 USDT, then selling for $11.54 million.

The decentralized revenue aggregation platform Yearn Finance was attacked, and the hackers made more than $10 million in profits. According to the analysis of SlowMist, the reason for this attack is that the attacker used the yUSDT contract to set the fulcrum address by mistake, thereby manipulating the stablecoin reserve balance in the yUSDT contract, and depositing USDT in yUSDT to obtain a large amount of unexpected yUSDT Tokens for profit.