Ostium Reports $23.75M USDC Loss from Off-Chain Oracle Exploit

Ostium pins $23.75M USDC drain on off‑chain breach, not smart contracts Ostium says a July exploit that siphoned 23.75 million USDC from its public liquidity (OLP) vault was the result of compromised off‑chain infrastructure and manipulated price reporting — not a bug in its smart contracts or a breach of governance multisigs. What happened - In a post‑mortem published Wednesday, Ostium reported that an attacker obtained unauthorized access to its off‑chain systems and submitted fraudulent BTC‑USD price reports. Those manipulated prices produced artificial trading profits for the attacker while the losses hit the OLP vault. - The team found no evidence that smart contract logic or the multisigs controlling governance were compromised. Instead, the attacker abused forwarder paths the protocol already recognized as valid. - The exploit began with a small test trade: a 100 USDC position that generated roughly 897.8 USDC in fake profit. After that trial, the attacker executed a primary batch that moved about 11.9 million USDC to a beneficiary wallet, followed by six additional standalone cycles. Total loss from the OLP vault: 23.75 million USDC. Earlier analysis and how it aligns - Blockchain security firm Blockaid had earlier attributed the incident to a compromised oracle signer private key, saying the attacker bypassed Ostium’s price verification by submitting manipulated reports through a registered PriceUpKeep forwarder. Blockaid’s on‑chain monitoring initially estimated withdrawals between $11.86M and $18M across roughly 20 trading loops while the attack was ongoing. - Ostium’s findings are consistent with that attack path: compromised signing credentials allowed fraudulent, future‑dated price reports to look valid, enabling repeated open/close trading cycles that netted profits for the attacker and losses for the liquidity pool — not because of a smart contract flaw. Response and impact - Ostium’s automated monitoring detected the abnormal activity before further drains could occur. The protocol halted trading during the investigation, migrated to a new production environment with tightened security controls, and resumed trading on July 23. - Trader collateral was unaffected because user margin remained inside trading contracts rather than in the compromised liquidity pool. - Ostium is finalizing a recovery plan for affected liquidity providers and says it will publish a dedicated update with details. Wider implications - The incident underscores the broader risk in DeFi stemming from off‑chain infrastructure and oracle systems used to feed market data. Ostium and Blockaid’s analyses both point to supporting infrastructure — not core smart contract code — as the weak link in this exploit. Context - The exploit came weeks after Ostium announced a May partnership with Nasdaq to support equity perpetual products using Nasdaq’s market data. Ostium has previously disclosed it processed more than $50 billion in cumulative trading volume and raised about $27.8 million from investors including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute and GSR. Ostium has closed its initial investigation into the on‑chain mechanics and is preparing further communications on liquidity recovery for providers affected by the exploit. Stay tuned for that dedicated update.