Ostium's Own Price Feed Became the Weapon in an $18 Million Hack

Ostium lost $18 million from its Arbitrum vault

On 15 July 2026, an attacker drained about $18 million in USDC from the liquidity vault of Ostium, a decentralised perpetuals exchange on Arbitrum. Blockchain security firm Blockaid flagged the incident on the same day. Perpetual contracts let traders bet on an asset's price with no expiry date, and Ostium settles those trades in USDC, a dollar-pegged stablecoin. The vault holds the funds that liquidity providers deposit to back every trade. On-chain data placed the loss at close to 28% of the vault's roughly $63 million in total value locked (TVL).

The attacker fed the price system future-dated data

Ostium runs a custom price-feed system to value assets on-chain. Gelato, a third-party automation network, posts asset prices at set intervals, while a component called the PriceUpKeep forwarder pushes oracle updates when trades execute. The attacker used a registered PriceUpKeep forwarder to submit reports carrying future-dated timestamps. Those fake prices made unprofitable trades look profitable and triggered the vault payout. According to crypto.news, a compromised oracle signer key let the attacker bypass the protocol's verification checks. The attacker opened and closed positions in a loop, extracting value without taking real market risk.

"An attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering a ~$18M USDC payout from the vault.", 15 July 2026. — Blockaid, blockchain security firm

Ostium paused trading after the vault drain

Ostium halted all trading once the exploit surfaced. Liquidity providers, who supply the vault's capital, bear the direct loss from the drained funds. According to CryptoBriefing, the attacker converted part of the stolen USDC into Ether (ETH) through the Kyber Network, then spread the proceeds across several wallets. That movement complicates any attempt to trace or recover the funds. The team has not yet announced a plan to repay affected liquidity providers, and an $18 million loss represents a large share of the protocol's funding.

The protocol raised $27.8 million before the hack

Ostium had raised $27.8 million in total funding, including a $24 million Series A co-led by General Catalyst and Jump Crypto in late 2025. The exchange lets users trade real-world assets such as gold, forex, and equity indices with leverage up to 200x, all settling in USDC. It had processed over $50 billion in cumulative trading volume before the attack. According to CryptoBriefing, Ostium had also partnered with Nasdaq for equity data. That deal positioned it as a bridge between traditional markets and DeFi.

ARB traded near nine cents at publication

ARB, the Arbitrum network token, traded at $0.0889 at the time of publication, up 1.33% over the past 24 hours (CoinPaprika, 17 July 2026). ARB's market value stood near $566 million at that price (CoinPaprika, 17 July 2026). The exploit struck an application built on Arbitrum, not the base network itself, so it did not affect the chain's own operations.

Oracle exploits keep hitting DeFi protocols

The Ostium hack follows a run of oracle and keeper attacks across decentralised finance (DeFi). One week earlier, Summer.fi lost about $6 million through a similar exploit. Blockaid said these attacks target automated price systems that rely on future-dated reports or privileged roles. Perpetual exchanges depend on accurate, timely price feeds, which makes those feeds a recurring target.