Ostium Exploited for $18 Million in Ongoing Oracle Attack Wave

Ostium, a decentralized perpetuals exchange operating on the Arbitrum network, experienced an $18 million exploit due to an attacker manipulating its price-reporting infrastructure. The hacker submitted falsified future-dated oracle data to create the illusion of profitable trades, which led to a significant payout from the protocol’s vault.

The exploit exploited a registered component of Ostium's price-feed automation system, known as PriceUpKeep. By submitting oracle reports with altered time stamps, the attacker was able to trigger an $18 million payout in USDC from Ostium's liquidity vault. This incident marks a continuation of recent vulnerabilities seen across DeFi, including a $6 million exploit from Summer.fi the previous week.

Ostium focuses on trading real-world assets such as commodities and foreign exchange, allowing up to 200x leverage while settling trades in USDC. The platform had raised approximately $27.8 million in funding, including a notable $24 million Series A round led by General Catalyst and Jump Crypto, and had processed over $50 billion in trading volume before the attack.

The incident underscores the persistent risks associated with automated infrastructure in the DeFi space. "The attack illustrates the vulnerabilities in automated systems that rely on real-world price data," said a spokesperson from blockchain security firm Blockaid, which detected the exploit.

As DeFi continues to grow, stakeholders must remain vigilant against such exploits, which manipulate the timing or content of price data to drain funds from liquidity pools. Moving forward, it will be crucial to monitor how Ostium and other platforms bolster their security in response to these ongoing threats.