Yield Yak vote subdomain hit by drainer code, Blockaid says

Yield Yak's website frontend was compromised through its vote.yieldyak.com subdomain, where Blockaid said it detected code tied to the Eleven drainer toolkit. The security firm said the incident resembled a similar subdomain compromise at Gitcoin days earlier, with both attacks targeting secondary web infrastructure rather than the core application interface. Such drainer scripts are designed to trick users into approving wallet transactions that can transfer assets to attackers, making front-end compromises dangerous even when underlying smart contracts are unchanged. Yield Yak's main product, an auto-compounding yield farming protocol on Avalanche, runs on its primary domain, but users who connected wallets through the affected voting site may have been exposed. No confirmed loss figures had been provided by Blockaid or Yield Yak at the time of publication, and Blockaid urged users not to interact with the affected websites while the issue was investigated and remediated.