GoPlus: Suspected "project management address hacked" led to Ribbon Finance being attacked

Golden Finance reports that the GoPlus Chinese community on social media analyzed the principle behind the attack on the decentralized options protocol Ribbon Finance. The attacker upgraded the price oracle contract at address 0x657CDE to a malicious implementation contract, then set the expiration times for four tokens—stETH, Aave, PAXG, and LINK—to December 12, 2025, 16:00:00 (UTC+8) and tampered with the expiration prices to profit from the manipulated prices. It is noteworthy that the project’s contract had its transferOwnership state set to true at creation, enabling it to pass the contract security checks. Analysis shows that the attacker address may have originally been one of the project management addresses, which was later compromised by the hacker through social engineering attacks and other means, and used to carry out this attack.