Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack - Decrypt
In briefOstium lost about $18 million USDC in an oracle exploit on Wednesday. Attackers used a compromised oracle signer key to submit falsified future-dated price reports. The exploit drained nearly one-third. . .
In briefOstium lost about $18 million USDC in an oracle exploit on Wednesday. Attackers used a compromised oracle signer key to submit falsified future-dated price reports. The exploit drained nearly one-third of the protocol's liquidity. Ostium lost roughly $18 million on Wednesday after attackers compromised an oracle signer key and manipulated the decentralized perpetuals exchange's price feed to generate fake trading profits, according to blockchain security firm Blockaid. In aposton X, Blockaid said the attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trading profits, triggering the multi-million payout—in the form of the Circle-issuedstablecoinUSDC—from Ostium's liquidity vault. “We are aware of the issue with the OLP vault,” Ostiumwroteon X. “We have paused all trading. The team is investigating. ”Built onArbitrum,Ostiumoffers perpetual futures tied toreal-world assetsincluding stocks, commodities, foreign exchange markets, and indices. It operates as a decentralized exchange, orDEX, meaning users largely stay in control of their funds and do not provide personally identifiable information. At the time of the attack, the protocol held about $63 million in total value locked, meaning the exploit drained close to one-third of its liquidity. The attack comes amid one of the worst years on record for DeFi exploits. DeFi, or decentralized finance, refers to financial applications that operate natively on blockchain networks, without third-party intermediaries like banks. More than$840 millionwas stolen from DeFi protocols in the first five months of 2026, including$292 millionstolen from KelpDAO and$285 millionfrom Drift Protocol. Hackers also targeted Resolv Labs in June, stealing over$25 million. Security experts warn thatadvancesin artificial intelligence are accelerating exploit discovery. "AI is far better at reviewing code than most people and finding potential vulnerabilities in it," Danny Jenkins, CEO and co-founder ofThreatLocker, previously toldDecrypt. Jenkins said current AI systems are already accelerating vulnerability discovery, while newer models such as Mythos could significantly expand those capabilities, calling it an imminent “big problem. ”“It will be only a matter of time until someone bad gets access to it,” he said. In May, security researcher Taylor Hornby used Anthropic's ClaudeOpus 4. 8to identify a four-year-old counterfeitingvulnerabilityin Zcash, underscoring how frontier AI models are becoming increasingly effective at finding complex software flaws. Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.