Aperture Finance was attacked, and $17 million was stolen across multiple chains.

January 26 News, the decentralized finance protocol Aperture Finance confirmed that its V3 and V4 smart contracts were subjected to a serious security attack. The attacker exploited contract vulnerabilities to transfer user assets across multiple blockchains, including Ethereum, BNB Chain, Arbitrum, and Base. On-chain tracking data from security agencies shows that the funds lost in this incident amount to approximately $17 million, and the attack was not carried out through flash loans but by abusing the access permissions previously granted by users to the contracts.

Unlike traditional liquidity pools being drained, this attack targeted wallet authorization logic. Once users had approved contract operation permissions in the past, even if no transactions were made at present, attackers could directly mobilize these assets if there were vulnerabilities in the contracts. After discovering the anomaly, Aperture Finance shut down key front-end functions to prevent new authorizations and attempted to block further fund outflows.

Initial technical analysis indicates that the affected contracts had flaws in input validation and external calls, allowing attackers to trigger arbitrary operations and bypass security checks to transfer authorized wallet funds. Security teams such as Blockaid and TenArmor also issued risk alerts for the related attack addresses. On-chain records show that funds are continuously flowing into marked wallets.

The Aperture Finance team posted an emergency notice on X, stating that they are collaborating with external security partners to investigate the root cause of the incident and will publish a comprehensive post-incident analysis report once facts are confirmed. Some community users have called for compensation and recovery plans, but the team’s current priority remains risk control and protecting remaining assets.

The official also urges all users who have interacted with the Aperture V3 or V4 contracts to immediately revoke authorization for the vulnerable contract address 0xD83d960deBEC397fB149b51F8F37DD3B5CFA8913. Users can perform this operation through on-chain authorization management tools. Until the issue is thoroughly fixed, no new interactions should be made with the related contracts. This incident also serves as a reminder to DeFi participants that authorization management has become an equally important risk point as asset security.