Ostium Loses $18 Million in Oracle Exploit as Attackers Target DeFi Price Feeds

Decentralized perpetuals exchange Ostium was drained of roughly $18 million in USDC after an attacker manipulated the price-feed infrastructure the Arbitrum-based platform relies on to settle trades, according to an alert from blockchain security firm Blockaid.

Investigators say the attacker gained access to a registered forwarder tied to Ostium's automated price-reporting system, known as PriceUpKeep, and used it to submit oracle reports carrying falsified, future-dated timestamps. Those doctored reports made losing positions look profitable, tricking the protocol into paying out from its liquidity vault.

Ostium lets traders speculate on real-world assets such as commodities, foreign exchange and equity indices with leverage as high as 200x, settling everything in USDC. To track prices for those assets, the platform depends on a third-party automation network, Gelato, which pushes price updates on-chain through the PriceUpKeep contract whenever a trade needs to execute – the same mechanism the attacker allegedly abused.

The incident fits a broader pattern of oracle and keeper-system attacks that have hit decentralized finance repeatedly in recent months, including a $6 million exploit at Summer.fi just last week. In these attacks, bad actors typically find a way into privileged system roles and then quietly alter the timing or substance of price data to siphon funds from liquidity pools.

Ostium had previously raised roughly $27.8 million, including a $24 million Series A backed by General Catalyst and Jump Crypto, and says it has processed more than $50 billion in cumulative trading volume, underscoring how significant a platform it is within the DeFi derivatives space even as the exploit raises fresh questions about the resilience of automated oracle infrastructure industry-wide.