Aevo (Legacy Ribbon DOV Vaults) (2025) — Crypto Hack
Partially RecoveredLegacy Ribbon Finance DeFi Options Vaults on Aevo were exploited after a Dec 6 oracle upgrade let any user set prices for new assets, draining ~$2.7M.
Summary
Legacy Ribbon Finance DeFi Options Vaults on Aevo were exploited after a Dec 6 oracle upgrade let any user set prices for new assets, draining ~$2.7M.
How It Was Compromised — Oracle Manipulation via Oracle upgrade allowing any user to set prices for newly added assets
On December 12, 2025, Aevo's legacy Ribbon Finance DeFi Options Vaults (DOV) were exploited after a December 6 oracle upgrade inadvertently allowed any user to set prices for newly added assets. The attacker pushed arbitrary expiry prices for wstETH, AAVE, LINK, and WBTC, draining approximately $2.7M. The DAO forfeited ~$400k in positions and proposed a 19% haircut on withdrawals.
Fund Flow & Laundering Analysis
No laundering activity observed. Partial recovery via DAO forfeited positions (~$400k); 19% haircut on withdrawals proposed.