Incident case file

Yield Yak — Frontend Eleven Drainer Injection

Incident date June 24, 2026

1 views

ContainedAvalanche (frontend attack; fake wallet-connect modal targeted Phantomindicating cross-chainSolana wallet targeting despite Yield Yak being an Avalanche product)Frontend supply-chain attack (Eleven Drainer)Cluster: YAK-FE-2026-06

Estimated loss

—

Victims identified

Victim group joining is coming soon.

Investigation

50%

Facts and investigation

Attacker: MISSING — Eleven Drainer is a drainer-as-a-service kit; per-session collection addresses are not published by Blockaid or Yield Yak. See manual recovery checklist.

Funds moved to: MISSING — no aggregate or per-victim fund-flow data published. See manual recovery checklist.

Compromised subdomain: vote.yieldyak.com (flagged 'Malicious' by Blockaid scanner, scan time June 24, 2026, 6:29:25 AM UTC; underlying detection logged at 6:23:33 AM UTC as a 'Frontend Attack / Security' incident, severity Medium). Yield Yak's main product (Avalanche auto-compounding vaults) was not affected — only the voting subdomain. Detected C2/supporting infrastructure is IDENTICAL to the Gitcoin incident (GTC-FE-2026-06) three days prior, confirming the same operator or kit reused across

Timeline: T0 (June 24, 2026, detection logged 6:23:33 AM UTC, confirmed by scan at 6:29:25 AM UTC): Blockaid's detection system identifies a front-end attack on yieldyak.com via its subdomain vote.yieldyak.com, now containing 'Eleven Drainer' code. T0 (same window): Blockaid publishes a public alert via X (@blockaid_) explicitly noting the pattern match to the prior Gitcoin incident: 'Blockaid's system has identified a front-end attack on yieldyak[.]com by @yieldyak_. The site's subdomain - vote[.]yieldyak[.]com now contains code of eleven drainer. This follows yesterday's incident on @gitcoin which has operated in a similar way.' June 24, 2026 (last documented activity): Remediation in progress; no confirmed completion date, no post-mortem, no aggregate loss figure ever published by Yield Yak or Blockaid as of report compilation.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)