Ostium Halts Trading After Attacker Uses Compromised Oracle Key to Drain $18 Million

Ostium, a perpetual-futures decentralized exchange running on the Arbitrum network, paused all trading on July 15 after an attacker drained close to $18 million in USD Coin from its liquidity vault. The security firm Blockaid, which first flagged the incident, said the attacker gained control of an oracle signer key, the private key that authorizes the protocol's price feed.

The root cause was compromised access control, not a flaw in the smart contract's logic. With a registered signer under their control, the attacker submitted price reports carrying future-dated timestamps, which made losing trades appear profitable. The attacker then ran roughly 20 looped trades through delegated actions to force the vault to pay out. Because the falsified prices came through Ostium's own trusted infrastructure, the contract's verification checks passed. On-chain trackers put the loss between $12 million and $18 million, and some estimates ran higher. No funds have been recovered, and no attribution has been made public.

The Ostium drain is part of a broader pattern. Researchers at DeFiHackLabs this week also published a proof-of-concept for a validation-phase paymaster approval flaw at Lumi Finance, which is built on the ERC-4337 account-abstraction standard, and Ostium follows a reported $6 million drain at Summer.fi the prior week. The shared feature is that the trust boundary keeps moving from the contract code to the off-chain keys and keepers that feed it.