Yearn Finance just got hit hard — attackers managed to siphon off $9 million from the protocol.

The damage breakdown? Around $3M in ETH has already been funneled through Tornado Cash for obfuscation. The remaining $6 million? Still sitting in the attacker's wallet.

This incident hammers home a familiar lesson: while DeFi can deliver outsized returns, it comes packaged with equally outsized vulnerabilities. Smart contracts remain attractive honeypots, and exploits like this one underscore why security audits and risk management aren't optional — they're survival basics in this space.