Ostium loses $23.75M in off-chain price feed breach

Ostium lost 23.75M USDC in a July 15 breach due to compromised off-chain price feeds. The attacker used fake BTC-USD prices to drain funds. Recovery and investigations are ongoing.

Ostium experienced a significant security breach on July 15, leading to the theft of 23.75 million USDC from its OLP vault. The root cause was traced to a compromise in the platform’s off-chain infrastructure, specifically the system responsible for signing price feeds, rather than any vulnerability in its smart contracts or governance multisigs. The attacker exploited unauthorized access to submit fraudulent BTC-USD price reports, generating artificial trading profits and draining the vault through multiple transactions. Automated monitoring systems helped limit further losses, and trading was paused before being resumed. Liquidity providers absorbed the loss, and Ostium is now preparing a recovery plan. The stolen funds were converted to ETH and routed through Tornado Cash, with tracing efforts ongoing. This incident highlights the risks associated with off-chain operational systems in DeFi protocols.