ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

A critical DeFi exploit drained $9 million from Yearn Finance’s yETH pool by exploiting a gas-fee cache flaw. Attackers minted 235 septillion yETH tokens while depositing just 16 wei, highlighting vulnerabilities in DeFi accounting mechanisms.

Why This Matters

The DeFi exploit demonstrates how technical optimizations like gas-fee caching can introduce critical vulnerabilities. The scale of the attack—leveraging a 41-digit token amount—shows that idealized models of secure smart contracts often fail to account for edge cases in resource management, leading to massive financial losses.

Key Insights

• “DeFi exploit draining $9M via gas-fee cache flaw, 2025”
• “BPFDoor malware uses IPv6 and port hopping for stealth, 2025”
• “Fake VS Code extension distributed OctoRAT, 2025”

Practical Applications

• Use Case: DeFi protocols using gas-fee optimizations
• Pitfall: Overlooking cache management leading to exploits

References:

• https://thehackernews.com/2025/12/threatsday-bulletin-wi-fi-hack-npm-worm.html