Aevo's legacy Ribbon DOV vaults were drained of $2.7 million on December 12, 2025. An oracle upgrade created a decimal mismatch (8 vs 18 decimals) with legacy assets. The attacker exploited a publicly-accessible oracle price-setting function and minimal collateral requirements to create undercollateralized positions and drain the vaults.