On January 25, 2026, Aperture Finance V3/V4 contracts across Ethereum, Base, and Arbitrum were exploited for $3.67M via arbitrary external call vulnerability. Insufficient validation allowed attackers to abuse existing ERC-20 and ERC-721 approvals and drain assets without key compromise.