Legacy DeFi options vaults created by Ribbon Finance and later absorbed by Aevo were exploited for around $2.7 million on December 12.
The affected products were Ribbon’s DeFi Options Vaults, which once held more than $300 million in total value locked during DeFi’s peak.
Although Ribbon rebranded to Aevo in 2023, the legacy vault contracts continued operating on Ethereum (CRYPTO:ETH).
Aevo confirmed that its main Layer 2 derivatives exchange was not affected by the incident.
Security researchers traced the exploit to an oracle infrastructure upgrade deployed on December 6.
The upgrade unintentionally allowed any user to set prices for newly added assets.
An attacker exploited this flaw to manipulate price feeds and extract funds from the vaults.
Blockchain analyst Specter first identified suspicious outflows and linked them to the exploit contract.
The attacker drained hundreds of ETH and significant USDC before dispersing the funds.