Aevo Exchange Suffers $2.7 Million Oracle Exploit in Legacy Ribbon Vault Attack

A sophisticated oracle manipulation exploit drained approximately $2.7 million from Aevo’s legacy Ribbon Finance decentralized options vaults (DOVs), forcing the derivatives platform to permanently shutter its entire vault operation just hours after the attack was detected on December 14.

The exploit targeted vulnerabilities in oracle pricing mechanisms that had been recently upgraded, allowing attackers to manipulate price feeds and extract roughly 32% of assets held across all affected Ribbon vaults. The attack represents the latest in a series of oracle-based vulnerabilities that have plagued the decentralized finance sector throughout 2025.

Aevo, which operates as a high-performance derivatives exchange, confirmed the incident in a statement released late Saturday, announcing the immediate decommissioning of all Ribbon vault products. The exchange emphasized that the exploit was contained to the legacy vault infrastructure and did not affect its primary derivatives trading operations or user funds held in standard trading accounts.

The attack methodology appears consistent with recent oracle manipulation techniques that have become increasingly sophisticated this year. By exploiting timing discrepancies in price feed updates following the oracle upgrade, attackers were able to create artificial arbitrage opportunities that allowed them to drain vault assets before protective mechanisms could respond.

This incident adds to what has become a devastating year for DeFi security, with oracle-related exploits accounting for a significant portion of the sector’s losses. November alone witnessed $137 million in DeFi hacks, including major incidents affecting Balancer and Yearn Finance, pushing total 2025 DeFi losses beyond $2.5 billion according to industry tracking data.

The Ribbon Finance protocol, which specializes in structured products and yield generation through options strategies, had been integrated into Aevo’s platform to offer users access to sophisticated derivatives strategies. These DOV products automatically execute covered call and put strategies to generate yield for depositors, but their complex smart contract architecture creates multiple potential attack vectors.

Industry analysts note that oracle manipulation attacks have become particularly common in structured product protocols, where complex pricing mechanisms create opportunities for exploitation during periods of market volatility or system upgrades. The timing of this attack, occurring shortly after an oracle upgrade, suggests the exploit may have targeted specific vulnerabilities introduced during the transition process.

The incident highlights ongoing challenges facing the DeFi derivatives sector, where the combination of complex financial instruments and experimental technology continues to create security risks despite extensive auditing processes. Aevo’s decision to permanently discontinue the vault products rather than attempt repairs signals the severity of the underlying vulnerabilities discovered.

Market participants have responded cautiously to the news, with some expressing concern about the broader implications for structured DeFi products. The exploit’s success despite multiple security audits and the protocol’s established track record underscores the persistent risks facing yield-generating DeFi applications, particularly those involving complex oracle-dependent strategies.