Ostium Perp DEX Hit for $18 Million in Brutal Oracle Exploit
Arbitrum’s RWA perpetual platform Ostium misplaced almost $18 million USDC immediately after attackers compromised an oracle signer key and manipulated costs.
The root trigger was a compromised oracle signer non-public key. This allowed the attacker to bypass verification checks and submit favorable future costs. They executed round 20 looped trades by way of delegated actions, immediately profiting on the protocol’s expense with out real market publicity.
Exploit Drains One-Third of Vault in Hours
Security agency Blockaid first flagged the incident on July 15, 2026. The attacker used a registered PriceUpKeep forwarder and future-dated licensed oracle studies to generate synthetic buying and selling income. This triggered repeated open-and-close loops that drained funds from Ostium’s foremost liquidity vault.
Follow us on X to get the most recent information because it occurs
On-chain information exhibits roughly $11.86M–$18M USDC extracted from the vault, representing about 32-35% of its ~$34M TVL on the time of the assault. The major exploit transaction is publicly verifiable on Arbiscan.
Ostium is a number one decentralized perpetuals alternate centered on real-world belongings — equities, commodities, foreign exchange, and indices — constructed on Arbitrum.
Major Backing Meets Major Setback
The protocol had raised roughly $27.8 million from top-tier buyers together with General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR. Despite sturdy institutional help and a number of audits, the incident exposes persistent dangers in oracle-dependent RWA infrastructure.
The exploit is underneath lively investigation. Users ought to monitor official channels for withdrawal steerage and safety updates. The occasion underscores the necessity for hardened oracle key administration and real-time monitoring in hybrid DeFi protocols.
As the RWA perpetuals sector grows quickly, this breach serves as a well timed reminder: even well-funded initiatives stay weak to private-key and oracle assaults. Expect elevated scrutiny on comparable platforms in the approaching weeks.
The submit Ostium Perp DEX Hit for $18 Million in Brutal Oracle Exploit appeared first on BeInCrypto.