Yam Finance exploit (2026-09-12) — attacker addresses
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Reported: 2026-10-15
- Last updated: 2026-10-16
Yam Finance exploit on EVM, 2026-09-12. DeFiHackLabs summary: YamFinance - dormant-DAO quorum governance takeover drains legacy UMA farming contracts. Loss as recorded by DeFiHackLabs: ~$121K (48.085 WETH + 763.101 UMA). Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0x26881EacC00Bcccd7c4ebE14BD7840dD989Bf982 — labeled "attacker" (EVM) Sources: https://github.com/SunWeb3Sec/DeFiHack…