Ostium DEX loses $18M in oracle exploit on Arbitrum
6.9 Security Ostium's Arbitrum DEX lost up to $18M in USDC after an oracle exploit. The attacker manipulated prices to drain the vault. Trading is paused and an investigation is ongoing.
Ostium, a decentralized perpetuals exchange on Arbitrum specializing in real-world assets, suffered a major exploit that resulted in the loss of up to $18 million in USDC from its liquidity vault. The attacker compromised the oracle infrastructure by leveraging a registered PriceUpKeep forwarder and submitting future-dated, authorized oracle reports. This manipulation enabled the attacker to generate artificial trading profits through repeated open-and-close trading loops, draining funds from the vault without real market exposure. The exploit was first flagged by security firm Blockaid, with onchain data confirming the attacker's actions, including swapping stolen USDC for Ethereum and distributing it across multiple wallets. Ostium responded by immediately halting all trading and launching an investigation. This incident represents a significant portion of the protocol's total value locked and underscores persistent vulnerabilities in DeFi oracle and keeper systems. Ostium had recently raised substantial funding and processed billions in trading volume prior to the attack.
