{"investigation":{"slug":"ribbon","entity_name":"Ribbon Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Ribbon Finance is an Ethereum-based DeFi protocol that pioneered Theta Vaults (DeFi Options Vaults) for structured yield products, later expanding into the Aevo derivatives exchange. The protocol has experienced multiple serious incidents including a $2.7 million oracle exploit in December 2025 whose recovery plan drew widespread community condemnation, a 2021 Sybil attack on its token airdrop by a connected venture capital firm, and a DNS hijacking in 2022. Its native token RBN lost approximately 90% of its value in 2025 alone and sits more than 99% below its all-time high.","sections":[{"content":"Ribbon Finance launched in late 2020, co-founded by Julian Koh and Ken Chan. It pioneered the DeFi Options Vault (DOV) model, in which depositors sell covered calls or cash-secured puts on a weekly basis via automated auction, earning option premiums in return. The protocol expanded into Ribbon Lend, an uncollateralized lending marketplace for KYC/AML'd institutional market makers, and ultimately developed the Aevo derivatives exchange on a custom Ethereum rollup. In July 2023, the Ribbon DAO voted 99.68% in favor of merging Ribbon Finance into Aevo, authorizing a 1:1 conversion of RBN tokens to a new AEVO token and moving all structured products to the strategies.aevo.xyz domain. The core vault smart contracts — the legacy Ribbon DOVs — continued to operate under Aevo governance until being decommissioned following the December 2025 exploit.","heading":"Protocol Overview","sources":[{"url":"https://docs.ribbon.finance/","name":"docs.ribbon.finance","type":"other","credibility":3},{"url":"https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","name":"blockworks.co","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/news/ribbon-proposes-to-merge-into-aevo-wind-down-rbn-token-and-launch-new-token-aevo","name":"tokeninsight.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 12, 2025, legacy Ribbon DOV vaults were drained of approximately $2.7 million following an oracle vulnerability introduced six days earlier. A December 6 oracle upgrade updated price feed precision to 18 decimal places for newer assets (stETH, PAXG, LINK, AAVE), while USDC remained at 8 decimal places. This decimal mismatch, combined with an access control flaw in the proxy-based oracle stack, permitted any user to set expiry prices for newly created assets on the platform. The attacker deployed a malicious smart contract that created option products with near-future expiration dates and strike prices significantly below market rates, exploiting the decimal mismatch. Three accounts classified as fully collateralized with minimal actual collateral were used to mint large quantities of oTokens, with no maximum payout limit per account or option series preventing the drain. Assets stolen included ETH, wstETH, USDC, and WBTC, distributed across 15 wallet addresses. Aevo halted all Ribbon vaults immediately following discovery. The underlying Opyn protocol was not compromised; the vulnerability was specific to Ribbon's oracle configuration.","heading":"December 2025 Oracle Exploit ($2.7 Million)","sources":[{"url":"https://www.theblock.co/post/382461/aevos-legacy-ribbon-dov-vaults-exploited-for-2-7-million-following-oracle-upgrade","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-aevo-ribbon-finance-hack-december-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/ribbon-finance-hacked-for-2-7-million/","name":"cryptopolitan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Aevo's proposed recovery plan for the December 2025 exploit generated significant community backlash. Although vaults suffered approximately 32% losses, the team initially proposed a 19% reduction plan — a smaller haircut achieved by assuming that some of the largest affected accounts belonged to dormant users who had not interacted with the protocol for several years and would therefore not attempt to withdraw. The DAO also agreed to forfeit its own vault positions (approximately $400,000) to partially offset losses. Critics argued that using inactive depositors' funds to benefit active users constituted an unauthorized redistribution of assets, with one community member stating: 'You can't just steal money because it's been deposited for a while.' Community anger intensified when Aevo restricted public replies on its X (formerly Twitter) account to verified accounts only, widely interpreted as an attempt to suppress criticism. According to subsequent reporting, Aevo later reversed the initial proposal, with affected vault users ultimately facing a 100% loss on their positions rather than the initially proposed partial recovery. All Ribbon vaults were permanently disabled, with a claims window set through June 12, 2026.","heading":"Controversial Post-Exploit Recovery Plan","sources":[{"url":"https://www.coinspeaker.com/aevos-ribbon-vault-exploit-spurs-backlash-over-19-payout-plan/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/aevo-faces-criticism-over-ribbon-finance-exploit-recovery-plan-44840","name":"phemex.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.kucoin.com/news/flash/aevo-faces-backlash-over-proposed-recovery-plan-for-ribbon-finance-exploit","name":"kucoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In October 2021, pseudonymous analyst Gabagool.eth discovered that a researcher at Divergence Ventures — a venture capital firm with an investment position in Ribbon Finance — had executed a Sybil attack on the RBN token airdrop. The researcher used dozens of wallets to satisfy the minimum participation requirements for claiming tokens, extracting approximately $2.5 million (702 ETH) from the distribution. On-chain analysis revealed that multiple wallets had received Ribbon airdrops, sold them for ETH, and funneled the proceeds to a common parent wallet linked to an Ethereum Name Service domain identifying the Divergence researcher. Divergence acknowledged the Sybil attack the same day, stating it had 'crossed a line,' and returned 705 ETH to Ribbon's treasury. The firm claimed it was a 'TINY investor' in Ribbon and denied using insider information. Ribbon founder Julian Koh also denied that any material non-public information was shared with investors. The incident drew broad condemnation from the DeFi community and raised concerns about the ethics of airdrop distribution when protocol investors have advance knowledge of distribution mechanics.","heading":"2021 RBN Airdrop Sybil Attack by Connected VC Firm","sources":[{"url":"https://www.coindesk.com/tech/2021/10/08/airdrop-ethics-vc-firm-draws-ire-following-25m-ribbon-finance-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/divergence-ventures-accused-of-insider-trading-as-analyst-cashes-out-2-5m/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/ribbonfinancesybilattack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://coinquora.com/divergence-ventures-returns-705-eth-to-rbn-network-solves-airdrop-issues/","name":"coinquora.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In June 2022, Ribbon Finance confirmed that its website (app.ribbon.finance) had been subjected to a DNS hijacking attack. The domain was temporarily redirected to a malicious version that prompted users to approve fraudulent smart contracts. According to the team's official statement, the issue was remedied immediately upon discovery. Two users approved malicious contract interactions before the attack was contained; all funds held in the vault contracts themselves were reported as unaffected. The incident coincided with a broader period of TVL attrition for the protocol, which also saw over $100 million in withdrawals in May 2022 following the Terra/LUNA collapse.","heading":"2022 DNS Hijacking","sources":[{"url":"https://x.com/ribbonfinance/status/1540250826156871681","name":"x.com","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/news/ribbon-finance-had-attack-on-website-dns-with-all-funds-on-vault-contract-unaffected","name":"tokeninsight.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The RBN governance token reached an all-time high of approximately $5.54 and has since declined more than 99% from that peak. In 2025 alone, RBN fell from approximately $0.37 to $0.037, a decline of roughly 90%. Following the 1:1 RBN-to-AEVO token migration approved by governance in July 2023, the AEVO token also experienced severe depreciation. Protocol TVL, which once exceeded $300 million, contracted sharply and sat at approximately $11.6 million as of available data. DeFiLlama tracks continued decline through and following the Aevo rebranding period. The Theta Vault product category itself faced structural headwinds after the 2021-2022 bull market cycle, as option premium income contracted significantly during periods of low volatility.","heading":"Token Performance and TVL Decline","sources":[{"url":"https://defillama.com/protocol/ribbon-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/ribbon-finance","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/ribbon-finance/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Ribbon Finance's tokenomics have attracted criticism on multiple fronts. According to community analysis, whales hold approximately 95.45% of the circulating supply, raising significant centralization concerns. The vote-escrowed governance model (veRBN) creates opportunity-cost risk for lockers and has been criticized for concentrating effective governance power among large token holders. The Aevo merger proposal — while approved with 99.68% of votes in favor — also reflects concentrated voting power rather than broad community consensus, as most small holders do not participate in governance votes. Additionally, the protocol's decision to discontinue Ribbon's vault revenue sharing pending further AEVO tokenomics proposals left veRBN holders in a period of uncertainty about future economic benefits.","heading":"Governance and Centralization Concerns","sources":[{"url":"https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","name":"blockworks.co","type":"other","credibility":3},{"url":"https://gov.ribbon.finance/t/rgp-33-merge-ribbon-finance-into-aevo/709","name":"gov.ribbon.finance","type":"other","credibility":3},{"url":"https://docs.ribbon.finance/ribbonomics/overview-and-rbn-tokenomics","name":"docs.ribbon.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"Ribbon Lend was an uncollateralized institutional lending marketplace offering depositors enhanced stablecoin yields by lending to KYC/AML'd market makers including Wintermute and Folkvang. Industry analysts flagged the product's inherent counterparty risk at launch, noting that uncollateralized DeFi lending exposes retail depositors to the creditworthiness of institutional borrowers with limited recourse in a default scenario. A governance proposal (RGP-27) attempted to establish an insurance pool seeded with 1 million USDC from the Ribbon Treasury. According to available data, both institutional borrowers (Wintermute and Folkvang) repaid their obligations and loan utilization fell to 0%, meaning no defaults materialized. However, the product represents a structural category risk that is atypical for an on-chain protocol.","heading":"Ribbon Lend — Uncollateralized Lending Risk","sources":[{"url":"https://docs.ribbon.finance/ribbon-lend/introduction-to-ribbon-lend","name":"docs.ribbon.finance","type":"other","credibility":3},{"url":"https://www.fxstreet.com/cryptocurrencies/news/defi-token-holders-alert-ribbon-finances-lend-product-poses-risks-argues-analyst-202210181230","name":"fxstreet.com","type":"other","credibility":3},{"url":"https://gov.ribbon.finance/t/rgp-27-ribbon-lend-insurance-pool/652","name":"gov.ribbon.finance","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-11","event":"Ribbon Finance co-founded by Julian Koh and Ken Chan.","source":"","date_original":"2020-11-01"},{"date":"2021-05","event":"Theta Vaults (DeFi Options Vaults) launched on Ethereum mainnet.","source":"","date_original":"2021-05-01"},{"date":"2021-10-08","event":"Divergence Ventures researcher exposed for Sybil attack on RBN airdrop; approximately $2.5 million in tokens claimed via dozens of wallets. Funds returned same day.","source":""},{"date":"2022-05","event":"Protocol loses over $100 million in TVL amid Terra/LUNA collapse and crypto market panic.","source":"","date_original":"2022-05-01"},{"date":"2022-06-23","event":"DNS hijacking attack on app.ribbon.finance; two users approve malicious contracts; vault funds unaffected.","source":""},{"date":"2023-03","event":"Ribbon Finance launches Aevo options exchange mainnet on custom Ethereum rollup.","source":"","date_original":"2023-03-01"},{"date":"2023-07-25","event":"Ribbon DAO approves RGP-33 merging Ribbon Finance into Aevo with 99.68% of votes in favor; 1:1 RBN-to-AEVO token migration authorized.","source":""},{"date":"2025-12-06","event":"Aevo deploys oracle upgrade adding 18-decimal precision support for stETH, PAXG, LINK, and AAVE — inadvertently introducing decimal mismatch and access control vulnerability in legacy Ribbon vaults.","source":""},{"date":"2025-12-12","event":"Attacker exploits oracle vulnerability in legacy Ribbon DOV vaults, draining approximately $2.7 million across ETH, wstETH, USDC, and WBTC. Stolen funds distributed to 15 wallet addresses.","source":""},{"date":"2025-12-13","event":"Aevo halts all Ribbon vaults and proposes 19% haircut recovery plan, relying on assumed dormancy of inactive accounts to fund active users' partial compensation. Aevo restricts X replies to verified accounts amid community backlash.","source":""},{"date":"2025-12-18","event":"Aevo reportedly reverses initial recovery plan; affected vault depositors face 100% loss. All Ribbon vaults decommissioned with claims window through June 12, 2026.","source":""}],"sources_used":[{"url":"https://docs.ribbon.finance/","name":"docs.ribbon.finance","type":"other","archive_url":"http://web.archive.org/web/20260611162224/https://docs.ribbon.finance/","credibility":3,"archive_timestamp":"2026-06-11T16:22:24+00:00"},{"url":"https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","name":"blockworks.co","type":"other","archive_url":"http://web.archive.org/web/20260218064534/https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","credibility":3,"archive_timestamp":"2026-02-18T06:45:34+00:00"},{"url":"https://tokeninsight.com/en/news/ribbon-proposes-to-merge-into-aevo-wind-down-rbn-token-and-launch-new-token-aevo","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/382461/aevos-legacy-ribbon-dov-vaults-exploited-for-2-7-million-following-oracle-upgrade","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20251228113156/https://www.theblock.co/post/382461/aevos-legacy-ribbon-dov-vaults-exploited-for-2-7-million-following-oracle-upgrade","credibility":3,"archive_timestamp":"2025-12-28T11:31:56+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-aevo-ribbon-finance-hack-december-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260517002538/https://www.halborn.com/blog/post/explained-the-aevo-ribbon-finance-hack-december-2025","credibility":3,"archive_timestamp":"2026-05-17T00:25:38+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260521081816/https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","credibility":3,"archive_timestamp":"2026-05-21T08:18:16+00:00"},{"url":"https://www.cryptopolitan.com/ribbon-finance-hacked-for-2-7-million/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20260213015019/https://www.cryptopolitan.com/ribbon-finance-hacked-for-2-7-million/","credibility":3,"archive_timestamp":"2026-02-13T01:50:19+00:00"},{"url":"https://www.coinspeaker.com/aevos-ribbon-vault-exploit-spurs-backlash-over-19-payout-plan/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20260813152154/https://www.coinspeaker.com/aevos-ribbon-vault-exploit-spurs-backlash-over-19-payout-plan/","credibility":3,"archive_timestamp":"2026-08-13T15:21:54+00:00"},{"url":"https://phemex.com/news/article/aevo-faces-criticism-over-ribbon-finance-exploit-recovery-plan-44840","name":"phemex.com","type":"other","archive_url":"http://web.archive.org/web/20260122191739/https://phemex.com/news/article/aevo-faces-criticism-over-ribbon-finance-exploit-recovery-plan-44840","credibility":3,"archive_timestamp":"2026-01-22T19:17:39+00:00"},{"url":"https://www.kucoin.com/news/flash/aevo-faces-backlash-over-proposed-recovery-plan-for-ribbon-finance-exploit","name":"kucoin.com","type":"other","archive_url":"https://web.archive.org/web/20260829090310/https://www.kucoin.com/404","credibility":3,"archive_timestamp":"2026-08-29T09:03:10+00:00"},{"url":"https://www.coindesk.com/tech/2021/10/08/airdrop-ethics-vc-firm-draws-ire-following-25m-ribbon-finance-exploit","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260427094842/https://www.coindesk.com/tech/2021/10/08/airdrop-ethics-vc-firm-draws-ire-following-25m-ribbon-finance-exploit","credibility":3,"archive_timestamp":"2026-04-27T09:48:42+00:00"},{"url":"https://beincrypto.com/divergence-ventures-accused-of-insider-trading-as-analyst-cashes-out-2-5m/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://quadrigainitiative.com/casestudy/ribbonfinancesybilattack.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260829230645/https://quadrigainitiative.com/casestudy/ribbonfinancesybilattack.php","credibility":3,"archive_timestamp":"2026-08-29T23:06:45+00:00"},{"url":"https://coinquora.com/divergence-ventures-returns-705-eth-to-rbn-network-solves-airdrop-issues/","name":"coinquora.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/ribbonfinance/status/1540250826156871681","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://tokeninsight.com/en/news/ribbon-finance-had-attack-on-website-dns-with-all-funds-on-vault-contract-unaffected","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/ribbon-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251014050200/https://defillama.com/protocol/ribbon-finance","credibility":3,"archive_timestamp":"2025-10-14T05:02:00+00:00"},{"url":"https://www.coingecko.com/en/coins/ribbon-finance","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260421092907/https://www.coingecko.com/en/coins/ribbon-finance","credibility":3,"archive_timestamp":"2026-04-21T09:29:07+00:00"},{"url":"https://coinmarketcap.com/currencies/ribbon-finance/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260306184218/https://coinmarketcap.com/currencies/ribbon-finance/","credibility":3,"archive_timestamp":"2026-03-06T18:42:18+00:00"},{"url":"https://gov.ribbon.finance/t/rgp-33-merge-ribbon-finance-into-aevo/709","name":"gov.ribbon.finance","type":"other","archive_url":"http://web.archive.org/web/20251113001842/https://gov.ribbon.finance/t/rgp-33-merge-ribbon-finance-into-aevo/709","credibility":3,"archive_timestamp":"2025-11-13T00:18:42+00:00"},{"url":"https://docs.ribbon.finance/ribbonomics/overview-and-rbn-tokenomics","name":"docs.ribbon.finance","type":"other","archive_url":"http://web.archive.org/web/20260517211533/https://docs.ribbon.finance/ribbonomics/overview-and-rbn-tokenomics","credibility":3,"archive_timestamp":"2026-05-17T21:15:33+00:00"},{"url":"https://docs.ribbon.finance/ribbon-lend/introduction-to-ribbon-lend","name":"docs.ribbon.finance","type":"other","archive_url":"http://web.archive.org/web/20260611163248/https://docs.ribbon.finance/ribbon-lend/introduction-to-ribbon-lend","credibility":3,"archive_timestamp":"2026-06-11T16:32:48+00:00"},{"url":"https://www.fxstreet.com/cryptocurrencies/news/defi-token-holders-alert-ribbon-finances-lend-product-poses-risks-argues-analyst-202210181230","name":"fxstreet.com","type":"other","archive_url":"https://web.archive.org/web/20260830034949/https://www.fxstreet.com/cryptocurrencies/news/defi-token-holders-alert-ribbon-finances-lend-product-poses-risks-argues-analyst-202210181230","credibility":3,"archive_timestamp":"2026-08-30T03:49:49+00:00"},{"url":"https://gov.ribbon.finance/t/rgp-27-ribbon-lend-insurance-pool/652","name":"gov.ribbon.finance","type":"other","archive_url":"https://web.archive.org/web/20260829080551/https://gov.ribbon.finance/t/rgp-27-ribbon-lend-insurance-pool/652","credibility":3,"archive_timestamp":"2026-08-29T08:05:51+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:19.961453+00:00","updated_at":"2026-08-30T03:54:58.917537+00:00"}}