Hack history / 2026 / Hack or exploit
Yapeswap
Hack or exploit on Oct 25, 2026 · Malicious Proposal
IN REVIEWSOURCES DISAGREE ON DATE OR LOSS · 3 SOURCES
Lost
$22K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,107
among thefts by dollars lost
What happened
YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
In review: sources disagree on the date.
Details
- Date
- Oct 25, 2026
- Kind
- Hack or exploit
- Method
- Malicious Proposal
- How in
- Price, oracle and governance
- Target
- DeFi protocol
- Chains
- Ethereum
After the theft
- Returned by the attacker
- yes, amount not stated
“The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults.” (DefiLlama)
Reported by
Related incidents
BonkDAO 2026 · Hack or exploit · $20M
TermFinance Vaults 2026 · Hack or exploit · $8.5M
Astroport 2026 · Hack or exploit · $4.9M
Drop 2026 · Hack or exploit · $4.4M
RetoSwap 2026 · Hack or exploit · $2.7M
TermFinance Vaults 2026 · Hack or exploit · $8.5M
Astroport 2026 · Hack or exploit · $4.9M
Drop 2026 · Hack or exploit · $4.4M
RetoSwap 2026 · Hack or exploit · $2.7M
Cite this page
SwanBluechip, "Yapeswap hack, Oct 25, 2026: $22K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht6e7caada6a/ (data as of 2026-11-01).