The Ostium protocol on Arbitrum has incurred a loss of approximately $23.75 million due to an exploit that compromised oracle permissions. This incident marks a significant security breach within the decentralized finance space, emphasizing vulnerabilities linked to external price feeds.
On July 15, 2026, blockchain security firm Blockaid reported the discovery of the attack. The exploit involved the manipulation of price data through a tool known as PriceUpKeep Forwarder. Utilizing a fraudulent oracle report dated in the future, the attacker managed to withdraw funds from the protocol's liquidity vault, resulting in substantial financial damage.
According to PeckShield, the total amount siphoned from Ostium's resources reached nearly $24 million, as they detailed the transaction flows leading to the withdrawals. The exploit was not attributed to flaws in Ostium’s smart contracts; rather, it stemmed from unauthorized access to the oracle signer key. This access allowed the perpetrator to authorize misleading information, which the protocol then accepted, mistakenly facilitating profitable payouts.
The exploit occurred within a narrow window, lasting from 14:18 until 14:23 UTC. Kaledora, the founder of Ostium, confirmed that the team quickly identified unusual activity and took measures to pause all trading contracts within an hour of the attack. Currently, the protocol is collaborating with blockchain security experts and relevant authorities to assess the implications of the incident for users and the protocol itself.
Following the attack, blockchain researchers traced the wallet used by the hacker, revealing that it was funded with 1 ETH each from ChangeNOW and Bybit prior to the exploit. After gaining access to the liquidity vault, the attacker converted the stolen USDC into approximately 12,084 ETH and funneled the majority of the stolen funds through Tornado Cash, a cryptocurrency mixing service.
This incident highlights the growing risks faced by decentralized finance protocols dependent on external oracle services. Experts in the industry shows the importance of rigorous audits on smart contracts while warning that compromised infrastructure surrounding price feeds can lead to significant losses in the DeFi sector. The exploit affecting the Arbitrum RWA Protocol serves as a critical reminder of these vulnerabilities.
This article is for informational purposes only and does not constitute financial advice.
