Aevo's old vault was hacked and suffered a loss of US$2.7 million. The official launches a compensation plan: 20% off the compensation, and active users will be given priority.

The old version of the DeFi options vault (Ribbon DOV) left behind by Aevo (formerly Ribbon Finance) was hacked on December 12 due to a smart contract update vulnerability, resulting in a loss of approximately US$2.7 million. After the incident was exposed, Aevo responded that its main exchange platform was not affected, and proposed a compensation plan today (14th): the overall loss of the treasury was 32%, but active users can first withdraw funds with a deduction of only 19%, and are expected to receive further compensation after the six-month claim period.
(Preliminary summary: The hacker history of the old DeFi protocol Balancer: it encountered 6 security incidents in 5 years, with a total loss of hundreds of millions of dollars)
(Background supplement: Degen, a subsidiary of Aevo, launched "Thousand-fold U.S. Stock Leverage", the first batch to be launched on Coinbase, Robinhood, Circle and MicroStrategy)

A decentralized exchange focusing on cryptocurrency options (options) and perpetual contract trading Aevo (formerly known as Ribbon Finance) issued an announcement through the X platform on the evening of the 13th yesterday, confirming that its legacy Ribbon DOV (DeFi Options Vault) old version of the vault was hacked on December 12, causing a loss of approximately US$2.7 million. The official wrote in the post:

We regretfully confirm that due to a vulnerability in the smart contract update, the old version of the Ribbon DOV vault was attacked yesterday (12th), causing a loss of approximately US$2.7 million. We have taken immediate action to identify the root cause and are coordinating with CEX and security partners to ensure that the stolen funds are tracked and tagged.

To Aevo users and stakers: Aevo itself has not been affected in any way and will remain fully secure and functional. We are working on the best solution for Ribbon Legacy depositors; please stay tuned and we will issue an update within 24 hours. If you have any questions, you can contact us through the exchange’s private message or work order system.

We regret to confirm that the legacy Ribbon DOV vaults were exploited yesterday following a vulnerability in a smart contract update, resulting in a loss of approximately $2.7M USD.

We have immediately taken action to identify the root cause and are coordinating with CEXs and…

— Aevo (fka Ribbon Finance) (@ribbonfinance) December 13, 2025

Aevo proposed a compensation plan

Regarding this hacking incident, Aevo once again passed X this morning (14th) The platform issued an announcement, updated the latest progress, and proposed follow-up treatment plans for affected treasury depositors. The announcement states that all Ribbon vaults have ceased operations immediately and will be permanently deactivated. Users can withdraw funds through standard withdrawal procedures, but withdrawals need to wait for the contract upgrade, which will be opened next week and will be announced separately.

Aevo continued to point out that the overall treasury suffered a loss of about 32% due to this incident, but the official proposal is that when users withdraw funds, 19% of the funds will be deducted based on the value of their positions at the time of the attack before withdrawing money. This plan is mainly based on two reasons: first, the DAO will give up its own treasury position (worth approximately US$400,000) to partially offset the losses, reducing the net stolen amount to US$2.3 million; secondly, according to evidence, most of the large deposit accounts have been dormant in the past 2-4 years and will most likely not come to withdraw funds. Therefore, the official will give priority to active users and allow them to withdraw funds first in exchange for smaller losses.

Aevo further argued that given the expected high dormancy rate, users who withdraw within the claim window have a good chance of being fully compensated upon final distribution. The claims window will be open for six months, starting on December 12, 2025, and ending on June 12, 2026. During this period, users can withdraw the remaining funds after a fixed deduction of 19% of the funds (subject to sufficient funds). After the window ends, the DAO will liquidate all remaining assets and distribute them preferentially to users who have previously withdrawn, compensating for the 19% deduction or making up the available amount as much as possible.

Officials emphasized that this is the best solution for depositors under the current circumstances. While the vault will be decommissioned, the underlying technology remains the property of the DAO and may be redeployed with new versions in the future. If depositors are not satisfied with this proposal, they can submit an alternative proposal in accordance with the governance guidelines by Friday, December 19.

We have an update on the legacy Ribbon DOVs exploit, specifically the next steps we're proposing for impacted vault depositors.

If you have an active Ribbon vault position, please read carefully, as action will be required on your side.

All Ribbon vaults have been stopped and…

— Aevo (fka Ribbon Finance) (@ribbonfinance) December 14, 2025