Leaderboard
440All-time rank
Ribbon
Dec 12, 2025
$2.7M
Lost
$2.7M
Recovered
$0
Net loss
$2.7M
Unrecovered0% recovered
7 million on December 12, 2025. An oracle upgrade created a decimal mismatch (8 vs 18 decimals) with legacy assets.
The attacker exploited a publicly-accessible oracle price-setting function and minimal collateral requirements to create undercollateralized positions and drain the vaults.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Dec 12, 2025Exploit executed — $2.7M drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%