Two DeFi operating surfaces failed in the last 48 hours: an oracle signer compromise on a real-world asset perpetuals exchange, and a vault accounting exploit that forced a seven-year-old yield protocol to wind down entirely. Ostium / Arbitrum: On July 15, 2026, an attacker holding a compromised oracle signer private key used Ostium's registered PriceUpKeep forwarder to submit future-dated authorized oracle reports against the protocol's RWA perpetuals vault. The forwarder, a legitimate automation component, accepted the reports as valid because the signer key had not been revoked. The attacker opened and closed approximately 20 looped trades in a single executeBatch call, each round compounding the margin from roughly $1,000 to an eventual position that triggered an approximately $18 million USDC payout from the OLP liquidity vault. Blockaid and CertiK flagged the drain with loss estimates ranging from $18 million to $22 million, representing approximately 28% of the vault's pre-exploit TVL. Ostium halted all trading immediately and has recommended users revoke approvals for all protocol contracts pending investigation. No post-mortem has been published and no timeline for resuming trading has been given. The attack vector was not smart contract code. It was the external signing key that authorized price data delivery, the same infrastructure class that failed at Bonzo Lend on Hedera and at https://t.co/SVnV4cvqcc's Lazy Summer Protocol earlier this month. https://t.co/SVnV4cvqcc Labs: On July 16, https://t.co/SVnV4cvqcc Labs published a shutdown announcement confirming the company has no viable path forward following the July 6 flash-loan exploit of the Lazy Summer Protocol. The attacker manipulated the net asset value of two Ethereum USDC vaults in a single atomic transaction by donating overvalued Silo Varlamore vault tokens into strategy adapters that had been capped for offboarding but remained inside active share-price calculations. A deposit at the genuine price and a redemption against liquid assets at the inflated price extracted approximately $6.04 million: $5.64 million from the lower-risk USDC vault and roughly $400,000 from the higher-risk vault. The team stated that a meaningful portion of its own capital was held in the affected vaults, removing the runway needed to fund recovery work and continued operations. The https://t.co/SVnV4cvqcc interface and support channels will remain live until August 31, 2026. The Lazy Summer DAO, a separate governance body, retains control over the underlying protocol and is working to restore vault withdrawals and redemptions independently of the Labs company closure. https://t.co/SVnV4cvqcc operated for approximately seven years, spinning out from the Maker Foundation in June 2021, and the Lazy Summer Protocol had accumulated nearly $200 million in TVL during its first nine months before the exploit ended its commercial operation. Taken together, both failures trace to the same operating-layer gap: privileged off-chain infrastructure, an oracle signer key and a vault valuation calculation, that sat outside the audited smart contract code but sat directly in the path of user funds. Neither protocol was breached through its own contract logic. Both ended with full trading or operational shutdowns.