Alchemix Yearn yvVault user hit by $1M loss after malicious contract exploit

On-chain security firm PeckShield (@PeckShieldAlert) reported that an Alchemix Yearn yvVault position tied to $yvWETH was taken over, leading to an estimated $1 million loss. The incident traces back to the victim previously approving an unverified contract at 0x143a, deployed 10 days ago. PeckShield's reverse-engineering indicates the contract included a flaw that allowed arbitrary call execution, which the attacker used to transfer the victim's yvVault position. PeckShield has since published details of the vulnerable logic. Users are urged to review and revoke token approvals granted to unknown or unverified contracts to reduce asset risk.