Ribbon Finance hack: hackers stole $2,7 million through an oracle vulnerability

Key points:

• On December 12, hackers exploited a vulnerability in the Ribbon Finance oracle system and stole approximately $2,7 million.
• The bug appeared after a code upgrade and allowed the attacker to substitute arbitrary asset prices.

On December 12, hackers broke into Ribbon Finance smart contracts, which belong to the Aevo platform. According to blockchain security experts, due to an error in the oracle upgrade, attackers were able to manipulate prices and withdraw about $2,7 million.

The attack targeted Ribbon’s DeFi option vaults (DOV). At the peak of the DeFi market, more than $300 million was locked in them. Despite Ribbon Finance’s rebranding in 2023 and the project’s transition to Aevo, these vaults continued to operate on the Ethereum network. The Aevo team clarified that the second-layer exchange itself was not affected.

How the hack happened and what analysts found

The first to notice the suspicious transactions was blockchain analyst Specter. He identified the contract used in the attack, as well as the wallets to which the funds were withdrawn.

Source: X.com

The hacker withdrew hundreds of ETH and large amounts of USDC, then distributed them among 15 addresses — approximately 100 ETH to each.

Security researcher Liyi Zhou explained that the attacker exploited a vulnerability in the Opyn/Ribbon oracle system. Using proxy servers, he was able to substitute arbitrary prices for wstETH, AAVE, LINK, and WBTC assets with the same expiration date. This allowed him to carry out the attack.

According to Anton Cheng of Monarch DeFi, the problem arose after the oracle code was upgraded on December 6. This effectively allowed anyone to set prices for new assets. However, the main Opyn protocol was not hacked — the vulnerability only affected Ribbon settings.

After the incident, Aevo stopped all Ribbon vaults and announced their permanent closure. The losses amounted to about 32%, but the team proposed to reduce the amount of write-offs for users to 19% of the value of their positions at the time of the attack.

They explained this decision with two reasons:

• First, the DAO will lose its own funds in storage facilities, amounting to about $400 000, which will reduce the total damage to $2,3 million.
• Second, large deposits belonged mainly to inactive users who had not been active for the past two to four years.

Oracle manipulation remains one of the most common threats in DeFi. Earlier, a user of the Venus Protocol platform fell victim to phishing and suffered losses of $27 million.