Ostium DEX hit with $18M oracle exploit on Arbitrum

Ostium, an Arbitrum-based decentralized exchange for perpetuals trading, ground to a halt after an attacker successfully exploited a vulnerability in its price-reporting system. By compromising an oracle signer key, the hacker was able to submit false price data that manipulated how the protocol valued assets, allowing them to generate fake trading profits and extract roughly $18 million from Ostium’s liquidity vault.

The attack unfolded through a manipulation of Ostium’s oracle infrastructure, which normally serves as the reliable source of truth for market prices across the platform. Instead of reflecting real prices, the attacker fed future-dated price information that made losing positions appear profitable, triggering the protocol to pay out funds that should never have left the system. Once successful, they immediately began converting the proceeds from USDC into Ethereum and moving it across multiple wallets to obscure its origin.

Ostium responded quickly by shutting down all trading and asking users to revoke their contract approvals as a precautionary measure. Security firms are investigating the incident further, though losses are confirmed at approximately $18 million. This marks another chapter in a recurring pattern: DeFi protocols remain vulnerable to attacks that target the oracles they depend on, which makes securing these price-reporting systems a critical but challenging task.