PANews reported on December 1st that Yu Xian, founder of SlowMist, tweeted that the "white hat negotiation" messages appearing on the blockchain after the Yearn attack were fake and a phishing attack, consistent with the previous Balancer incident. The attackers used the Railgun protocol to conceal their identities, prepared a low-gas address 28 days in advance, and ultimately transferred 1000 ETH via Tornado Cash. The attackers' address currently holds approximately $6 million in crypto assets.