Ostium, a decentralized exchange operating on the Arbitrum network, has paused all trading activities after a security breach led to the loss of approximately $18 million in USDC from its liquidity vault. The incident, confirmed by the platform, was attributed to an exploit involving their oracle system.

Blockaid, an onchain security firm, reported that the attacker utilized a registered PriceUpKeep forwarder alongside future-dated oracle reports to fabricate trading profits, which resulted in a significant withdrawal from Ostium's vault. In response to the exploit, Ostium announced on X that they are investigating the matter.

Despite Blockaid estimating the drained amount at around $18 million, other independent observers have suggested the loss may be as low as $11.86 million. Ostium has not released its own figures regarding the total losses sustained during the attack.

Context of the Exploit

Prior to this incident, Ostium had approximately $63.3 million in total value locked (TVL), as per data from DefiLlama. The attack's impact is substantial, even at the lower estimated loss, representing a significant portion of the vault's total balance. This security breach follows a series of similar attacks within the DeFi space, where automated systems, including oracle and keeper infrastructures, have been compromised. For example, Summer.fi faced a similar fate earlier this year, losing around $6.04 million due to share-price manipulation.

Ostium operates a platform enabling users to trade perpetual contracts on various assets like gold, oil, equity indices, and foreign exchange, settling transactions in USDC. The protocol's OLP vault has facilitated over $33 billion in cumulative trading volume across more than 50 markets. The compromised component in this recent attack was previously deemed secure by Ostium's security team.

The vulnerabilities exploited in this incident highlight ongoing risks associated with relying on off-chain data for trading operations. Once an attacker gains access, it can trigger payouts on trades that do not yield actual profits.

This material is for informational purposes only and does not constitute financial advice.