Yieldly's legacy staking escrow released its ALGO without reading the payment

Five payments left a Yieldly staking contract account on the morning of October 15, 2026, within ninety-two seconds. Together they carried about 390,377 ALGO out of a vault the project had told users to empty three years earlier. The first was for about 14,374¹ ALGO and the last for about 174,763. The contract paid because its own books had been credited with a deposit that never arrived, in a token it never held.

That account is the escrow behind Yieldly's legacy staking dapp, where holders left their tokens to earn rewards. The project told them to take their stake out in April 2023 and again that July. What the vault still held was ALGO, and it stayed there behind a published program that appears to read neither the receiver nor the amount of a payment it signs.

A token minted eight seconds before it was spent

The account that took the money was opened that morning and funded with 1² ALGO. It minted a token called FUEL with no decimals and no manager, freeze, clawback or reserve role. Its creator sent the entire supply to its own address, a transfer that changed no balance.

Eight seconds later the escrow paid that same account 3,239,706,903.743672³ YLDY, roughly 3.24 billion⁴ tokens, a third of the 10 billion⁵ supply. The staking program appears to keep a balance for each account and to add to it the amount of a transfer without comparing the asset id. FUEL counts in whole units and YLDY in millionths, so one token's raw count was read as the other's.

Crediting that balance did not require sending the escrow anything. The check program in front of the deposit path returns success for any call that closes out a position, without reading an argument, so the guarded path can be skipped. The deposit branch then credits the amount of a payment without confirming the money reached the account that holds the funds.

The withdrawals follow the same shape. Each of the five was preceded about eight seconds earlier by the same account paying itself the identical amount, from about 14,374⁶ ALGO up to about 174,763, in groups where no address's balance changed. The deposits were entries in the contract's own records. The ALGO that left was the contract's own balance, not anything the sender had put in.

A vault that read nothing about the payment

The account that paid out is a logic signature, a small program with no private key to steal. Yieldly's deployer opened it with 2 ALGO on June 5, 2021. Its published program appears to approve a payment under three conditions. The group must hold between two and six transactions, and the first must be a call to one particular Yieldly application. Neither of the first two may set a rekey. It appears to read no receiver, amount or asset of the payment it signs.

Within those conditions it could sign a payment of any size, in any asset, to any address. On that reading, nothing appears to have needed breaking and no key needed finding. The program appears to ask nothing about who sends the payment, so an outsider and a former user met the same terms. The escrow's account page⁷ now shows 0.20107⁸ ALGO, just above the 0.2 ALGO minimum that keeps it open.

The 400k in the headline is a payment made later

The thread⁹ that raised this on r/AlgorandOfficial said the staking contract had been 'hacked for 400k¹⁰ Algo', and pointed at Halborn's 2021 audit. Replies split between calling it a hack and blaming the operators. The figure behind the headline, 404,751.140877¹¹ ALGO, is a single transfer the receiving wallet made four minutes after the last withdrawal, and it is larger than what the vault released.

It is the vault money plus the proceeds of the credited tokens. The account sold 1,898,163,508.442098¹² YLDY to a contract account for 8,435.734854¹³ ALGO, and 1,341,543,395.301573¹⁴ YLDY into a Tinyman pool for 5,934.490389¹⁵. The two sales brought in 14,370.225243¹⁶ ALGO. Add that to the amount the vault released and the sum lands a few ALGO short of the 404,751.140877¹⁷ sent onward, a difference the record does not close.

YLDY itself is worth little now: about $2,878 of market value, on $13.44 of trading in a day, as of October 19.

The onward payment moved again within hours. It passed through two more ordinary accounts, and the last of them sent 220,000 ALGO onward on October 19. None of the three resolves to a name.

The audit tested different code

Halborn's engagement ran from May 8 to 19, 2021 and covered Yieldly's lottery contracts. The report¹⁸ says that, under time and resource constraints, only the most essential aspects were tested. According to the report, one of its five findings, HAL-02, rated Low, described transactions that did not pass through the proxy while the escrow expected them to, at this same boundary.

The programs that paid out were shipped afterwards. Both staking applications were last updated on July 2, 2021, after the engagement closed, and neither has changed since. Citing that audit as assurance about the staking vault places the trust in code that was not running in October.

Three years after the shutdown notice

Yieldly told holders to withdraw in April 2023, then again in July. The April 20 post¹⁹ read: 'Remove your stake from Yieldly staking before the dapp is taken offline within 30 days,²⁰' and gave the end of May for decommissioning. A July 25 announcement²¹ asked users to 'remove your funds from Yieldly staking before 10pm EST 26th July²²'. The five payments came 1,177 days after that deadline.

Yieldly has said nothing about the transfers. Its announcement channel²³ has not posted since March 2024, its Medium feed²⁴ since April 2023, and its X account²⁵ carries nothing later than January 2025.

The dapp is gone; the contracts stayed. The escrow still sent YLDY out in 2025, including 112,376,408.272 tokens in one transfer on August 4, so the program was still answering somebody. What it also held was ALGO, and that is what went. The other application escrows the programs name now hold nothing.