Ostium's July 15 security breach resulted in a loss of 23,752,746 USDC after an attacker exploited compromised oracle credentials to submit fabricated market prices, according to the protocol's team. "The attacker managed to pass false price reports as legitimate, enabling fraudulent profit payouts," Ostium stated on Twitter. The exploit affected the platform's liquidity-provider vault on Arbitrum and led to trading suspension as the team works on a secure relaunch.

The attacker gained access to privileged off-chain components responsible for feeding pricing data into Ostium's perpetual contracts, which cover a range of assets from stocks and commodities to cryptocurrencies. These false prices were accepted by the protocol’s verifier because it only confirmed that reports were signed by authorized oracles, but not whether the prices corresponded to actual market values. This allowed repeated opening and closing of positions based on fabricated profits paid out of the OLP vault.

Galaxy Research traced eight payments totaling roughly $23.75 million USDC funneled into a single wallet, including large transfers of approximately $11.86 million, $4.49 million, and $3.59 million. Afterward, much of the stolen USDC was converted into 12,084 ETH, which then entered Tornado Cash, complicating recovery efforts. trader collateral remained isolated, but open positions are frozen until Ostium finalizes enhanced security measures and resumes operations.

The incident highlights vulnerabilities in oracle infrastructure rather than the protocol’s core trading contracts, as the exploit relied on stolen credentials connected to an authorized oracle signer and a PriceUpKeep forwarder. These privileges enabled future-dated price reports to pass verification, facilitating ongoing cycles of artificial gains. Ostium is focused on strengthening safeguards before restarting trading. For related market analysis, see also Ostium Protocol Suffers 23.75M Loss in Manipulated USDC Price Attack.

Disclaimer: This article is for informational purposes only and does not constitute financial advice.