A recent exploit on Ethereum’s Aperture Finance platform resulted in the theft of approximately 37 wBTC coins, equivalent to more than $3 million at the time of the attack.
The incident occurred due to a vulnerability in a smart contract deployed in the base layer, as reported on January 25 by the on-chain researcher and auditor known in X as pashov.
The transaction associated with the attack, visible in the Etherscan explorer, reveals a transfer of almost 37 wBTC from an address linked to the exploited contract to another account, for an estimated value of USD 3,223,469 at the time of the movement.
The affected asset, Wrapped Bitcoin (wBTC), as NoticiasVE explained it, is a wrapped bitcoin (BTC) token that runs on Ethereum. Each wBTC is backed one-to-one by real BTC, and allows wBTC to be used within the ecosystem of smart contracts, decentralized finance applications, and exchange protocols on Ethereum.
Details of the exploit that caused the theft of USD 3 million in wBTC
The attack occurred against a contract that was barely 41 days old, whose code had not been verified or published in human readable formatPashov noted.
In practice, this means that only the binary code that runs the network (the compiled version that machines understand) was available, but not the open source code that allows developers and users to analyze its logic in order to detect possible failures before interacting with the contract.
The veracity of what Pashov provided can be corroborated directly in Etherscan by reviewing the address of the smart contract with which the victim interacted, and which executed the logic that allowed the funds to be drained:
In the image you can see that, when accessing the tab “Contract” (contract), the verified source code does not appear in the Ethereum language, Solidity, but only a long hexadecimal sequence corresponding to the compiled code that executes the Ethereum Virtual Machine.
Additionally, at the top of that section, Etherscan displays the prompt for “Verify and Publish your contract source code” (Verify and publish the source code of your contract). This confirms that the contract does not have public or readable source codethus validating that it was an unverified contract.
In addition, the address indicated as responsible for the hack keeps the funds at the time of this writing.
Response from the Aperture Finance platform after the 37 wBTC exploit
Aperture Finance confirmed that the exploit impacted Aperture V3 and V4 contracts, and that, as an immediate measure, They disabled key features of their app to prevent new spending approvals.
In addition, they reported that they are investigating the origin of the incident together with specialized security partners.
Finally, as an urgent action, they recommended to users revoke all approvals granted to the committed contract on the Ethereum mainnet, as the team prepares a detailed technical report (post-mortem) and communicates new updates once the facts are verified.