SlowMist founder Yu Xian tweeted that the "white hat negotiation" messages appearing on the blockchain after the Yearn attack were fake and a phishing attack, consistent with the previous Balancer incident.
The attackers used the Railgun protocol to conceal their identities, prepared a low-gas address 28 days in advance, and successfully exploited it, ultimately transferring 1,000 ETH via Tornado Cash. The attacker's address currently holds approximately $6 million in crypto assets.