Ostium Halts Trading After $18 Million Oracle Exploit Drains Liquidity Vault

Decentralized perpetuals exchange Ostium suspended all trading Wednesday after attackers exploited a critical vulnerability in its price-feed infrastructure, draining roughly $18 million in USDC from its main liquidity vault. The incident, first flagged by blockchain security firm Blockaid, marks the latest in a growing wave of oracle manipulation attacks targeting decentralized finance platforms.

The breach occurred on Arbitrum, where Ostium operates as a venue for leveraged trading of tokenized real-world assets including equities, commodities, foreign exchange, and indices. Blockaid reported that the attacker gained control of an oracle signer private key, then used a registered PriceUpKeep forwarder to submit authorized oracle reports with future-dated timestamps. These manipulated reports created the appearance of profitable trades, triggering repeated payouts from the protocol's OLP vault without any genuine market exposure.

"The attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering a ~$18M USDC payout from the vault," Blockaid stated in its alert posted on X.

Co-founder Kaledora acknowledged the unauthorized outflow in a statement, explaining that the team had identified the issue and was coordinating with law enforcement and third-party security experts. While he did not confirm the exact amount lost, he emphasized that trading contracts had been paused as part of the immediate response.

While Blockaid and on-chain data point to approximately $18 million extracted from the vault, other security firms have published divergent figures. CertiK placed the loss closer to $22 million, while ExVul reported that $11.86 million in USDC left the vault—representing roughly 32% of Ostium's total value locked at the time. The primary exploit transaction is publicly verifiable on Arbiscan.

The discrepancy in estimates reflects the challenge of tracking funds in real time during active DeFi exploits, where attackers often move assets across multiple addresses and protocols. Defimon Alerts logged an even higher figure of approximately $20 million, while also noting that 11,862,445 USDC was drained from the vault.

Ostium has not independently confirmed any of these figures. "The team is actively investigating with relevant security experts. We will provide updates as they come," the protocol posted on X.

The exploit did not target a flaw in Ostium's smart contract code. Instead, it abused the trusted oracle infrastructure that feeds external price data onto the blockchain. Ostium uses a third-party automation network called Gelato to push real-world asset prices onchain at precise intervals. A smart contract called PriceUpKeep sits at the center of this process, acting as the trigger that writes the latest price data whenever a trade needs to be executed.

According to Blockaid, the attacker executed around 20 looped trades through delegated actions. By submitting manipulated oracle reports that passed the protocol's verification checks, each trade appeared legitimate while transferring losses directly to the liquidity vault. The funds were extracted as USDC, the stablecoin that settles all positions on Ostium.

ExVul wrote on X that "the attack stems from a Private Key Compromise (Oracle Signer) resulting in price manipulation." This assessment aligns with the broader pattern of recent DeFi attacks, which increasingly target offchain infrastructure—oracle systems, privileged access controls, and key management processes—rather than exploiting smart contract vulnerabilities alone.

The attack drained approximately 28% of Ostium's $63 million total value locked at the time of the incident, according to on-chain data. This represents a significant of the protocol's pooled liquidity, which backs trading positions and related settlement flows.

Ostium had raised approximately $27.8 million from a roster of prominent investors including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR. The protocol closed a $20 million Series A round in December 2025 co-led by General Catalyst and Jump, and had processed over $50 billion in cumulative trading volume before the exploit.

The platform offers leveraged exposure to 75 trading pairs spanning stocks, ETFs, commodities, indices, foreign exchange, and cryptocurrencies. With more than 26,000 active traders and $51 billion in total trading volume, Ostium positioned itself as a leading venue for onchain real-world asset trading.

Despite multiple security audits and institutional backing, the incident exposes the persistent risks in oracle-dependent infrastructure. A single compromised signer key was sufficient to bypass trusted price verification and inflict multimillion-dollar losses within hours.

The Ostium exploit follows a string of similar incidents. Last week, Summer.fi suffered a $6 million loss from a parallel attack targeting critical price data components. In April, crypto hacks resulted in nearly $630 million in losses—the highest monthly total since February 2025—with DeFi protocols accounting for the vast majority. Exploits at KelpDAO and Drift Protocol alone represented more than 80% of that month's total.

The second quarter of 2026 closed as the most attack-heavy quarter on record by incident count, with roughly 83 separate exploits through late June. Compromised administrator credentials and fake price manipulation accounted for 37% of those losses, while private-key theft represented another 5.7%. An oracle-signer compromise of the kind described at Ostium sits squarely inside that trend.

Security researchers have warned that the threat focus is shifting. Instead of only exploiting weaknesses in smart contracts directly, attackers increasingly target offchain infrastructure—particularly oracle systems, privileged access controls, and key management processes.

In the immediate aftermath, Ostium recommended that users temporarily revoke approvals for its contracts as a defensive measure. "With user security being our first concern, we recommend that all users temporarily revoke approvals for our contracts until we can further investigate the recent incident," the protocol stated.

The team confirmed that all trader funds and open positions are currently preserved as-is, frozen in the trading storage contract. This pause prevents further interaction with the platform while investigators examine the affected contracts and oracle pathways.

For users and liquidity providers, the incident raises immediate concerns fund recovery and the timeline for resuming normal operations. Ostium has not yet released a detailed technical assessment explaining how the oracle system was compromised, which specific contracts were affected, or whether user funds remain fully recoverable.

The protocol's steps will be critical for restoring confidence. Investors and users will be watching for a fuller incident report that clarifies the root cause, outlines changes to oracle design or control mechanisms, and provides a clear path for the safe resumption of trading and liquidity operations.

The attack also carries broader implications for institutional adoption of DeFi. As more protocols expand beyond crypto-native assets into stocks, commodities, foreign exchange, and indices, oracle security becomes a core part of the sector's credibility. High yields and broad market access are less persuasive when infrastructure risk can erase vault capital in a single incident.

Industry executives have warned that shrinking DeFi yields make security risks harder to justify. In a May conversation cited by Cointelegraph, the CEO of smart contract security firm Statemind and Symbiotic co-founder Misha Putiatin said institutions increasingly struggle to quantify hack risk, which can reduce appetite for sector exposure despite rising interest in blockchain-based finance.

The Ostium incident reinforces a wider market lesson: DeFi trading platforms are only as strong as the systems that feed them prices.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.