The decentralized perpetual trading platform Ostium on Arbitrum suffered an oracle attack, resulting in approximately $18 million in USDC being drained from the protocol’s liquidity vault. Security firm Blockaid stated that the attacker fabricated price reports to create false profits and executed the fund withdrawal.
The attack exploits the signing key.
According to Blockaid’s disclosure, the attacker gained control of the oracle’s signing key and used a registered PriceUpKeep relayer to submit future-dated price reports with authorized signatures, thereby manipulating Ostium’s price feed system.
During this process, the protocol calculated and paid out large amounts of USDC to the attacker based on non-existent profit positions. Ostium later stated on X that the team had noticed an anomaly in the OLP treasury, paused all trading, and is currently investigating the incident.
Approximately one-third of liquidity has flowed out.
Ostium is deployed on Arbitrum and offers perpetual contracts tied to real-world assets such as stocks, commodities, forex, and indices. At the time of the incident, the protocol's total value locked was approximately $63 million, with this loss approaching one-third of its liquidity.
DeFi security incidents continue to increase
The report states that, in the first five months of 2026, DeFi protocols have suffered losses exceeding $840 million due to thefts. Among these, KelpDAO lost approximately $292 million, and Drift Protocol lost approximately $285 million. In June, Resolv Labs was also attacked, suffering losses of over $25 million.
Some security researchers believe AI tools are accelerating the discovery of vulnerabilities. Previously, security professionals noted that existing models can already inspect code more quickly and identify potential flaws. In May, researchers used Anthropic’s Claude Opus model to uncover a four-year-old forgery vulnerability in Zcash.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
