Oracle · CoinDesk
Ostium suffers $18 million exploit as oracle attack wave continues to hit DeFi
Compiled by KHAO Editorial — aggregated from 1 source + 2 references discovered via search. See llms.txt for citation guidance.
★ Tier-1 Source
An attacker drained approximately $18 million in USDC from Ostium's liquidity vault on Arbitrum in an oracle manipulation exploit detected by blockchain security firm Blockaid, onchain data shows.
Key facts
- Ostium had raised $27.8 million in total funding, including a $24 million Series A co-led by General Catalyst and Jump Crypto in late 2025, and had processed over $50 billion in cumulative trading
- CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B
- An attacker drained approximately $18 million in USDC from Ostium's liquidity vault on Arbitrum in an oracle manipulation exploit detected by blockchain security firm Blockaid, onchain data shows
- The attack is consistent with a pattern of oracle and keeper-system exploits seen across DeFi in recent years, the most recent of which saw $6 million drained from Summer.fi last week
Summary
An attacker exploited a registered component of Ostium's price-feed automation system, submitting oracle reports with manipulated future timestamps to make losing trades appear profitable, triggering an $18 million USDC payout from the protocol's vault. The attack follows a string of similar keeper and oracle exploits in DeFi, including a $6 million drain from Summer.fi last week, highlighting persistent vulnerabilities in the automated infrastructure protocols rely on to bring real-world price data onchain. Ostium, a perpetuals exchange on Arbitrum focused on real-world assets like gold, forex, and equity indices, had raised $27.8 million in funding and processed over $50 billion in trading volume before the incident. According to Blockaid's alert, the attacker leveraged a registered PriceUpKeep forwarder, a component of Ostium's automated infrastructure, to submit oracle price reports with future-dated timestamps.