Ostium Halts Trading After Future-Dated Price Reports Drain Up to $24 Million

Ostium, a decentralized venue for trading perpetual contracts on real-world assets built on the Ethereum layer-2 network Arbitrum, paused all trading after an attacker exploited its own price-reporting system. The incident lasted roughly five minutes on July 15, from 14:18 to 14:23 Coordinated Universal Time (UTC), and drained the protocol's public liquidity vault.

The mechanism was oracle manipulation through a trusted path, not a broken contract. According to CryptoSlate, the attacker used a registered price-update forwarder to submit oracle reports carrying future-dated timestamps. Because the reports came through an authorized signer, the authentication check passed even though the data was false. The attacker opened a position at the real market price, then pushed a fabricated price showing a sharp move in their favor, closed the position, and the contracts automatically paid the artificial profit in the dollar stablecoin USDC.

Estimates of the loss diverge. CoinDesk put the figure near $18 million, while on-chain analysis cited by CryptoSlate traced up to $24 million moved out of the vault. The security firm PeckShield reported the stolen USDC was swapped into about 12,080 ether, of which roughly 10,540 reached the mixing service Tornado Cash. Ostium said it is working with law enforcement and outside firms and has not published a final accounting. No funds have been recovered or frozen as of this writing.

The root cause sits at the boundary between authentication and validation. The system verified who sent the price but not whether the price was plausible. That is the recurring weakness in oracle-fed derivatives: a signature that is trusted absolutely becomes a single point of failure the moment the signing path is abused.