On January 25, 2026, Aperture Finance was attacked due to a smart contract vulnerability, resulting in a loss of approximately $3.67 million. The attack stemmed from vulnerabilities in its V3 and V4 contracts. The attacker exploited existing user token authorizations to steal funds, then laundered 1,242 ETH through Tornado Cash, worth $2.4 million. The platform's security team urges users to immediately revoke all ERC-20 token and liquidity position (ERC-721) authorizations associated with the compromised contract addresses.