Ostium has halted trading after an exploit tied to a compromised oracle signer key drained nearly $18 million USDC from its liquidity vault, according to blockchain security firm Blockaid. Summary Blockaid linked Ostium’s $18 million exploit to a compromised oracle signer key. The attacker drained up to 28% of the protocol’s $63 million liquidity vault. Ostium halted trading as investigators probe the oracle-based attack. Blockaid reported that the attacker gained control of an oracle signer private key, allowing them to bypass the protocol’s verification process and submit future-dated price reports that favored their trades. Using a registered PriceUpKeep forwarder, the attacker repeatedly opened and closed positions through delegated actions, extracting profits without taking genuine market risk. 🚨 Blockaid detected an @Ostium Vault exploit on Arbitrum.An attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering a ~$18M USDC payout from the vault.More details in 🧵— Blockaid (@blockaid_) July 15, 2026 The security firm said the exploit triggered around 20 trading loops that steadily drained funds from Ostium’s main vault. On-chain records show the attacker withdrew between $11.86 million and $18 million USDC, equal to roughly 28% of the protocol’s $63 million total value locked at the time of the incident. The primary exploit transaction can be verified on Arbiscan. Ostium, which operates on Arbitrum, offers decentralized perpetual trading for tokenized real-world assets, including equities, commodities, foreign exchange markets and stock indices. Oracle key compromise enabled repeated profit extraction Instead of exploiting a flaw in smart contract code, the attacker abused trusted oracle infrastructure after obtaining a valid signer key. According to Blockaid, the manipulated oracle reports allowed favorable prices to pass protocol checks, making each trade appear legitimate while transferring losses to the liquidity vault. The incident has renewed attention on oracle security as decentralized finance protocols increasingly depend on external data feeds for pricing. Blockaid attributed the exploit to compromised signing credentials rather than a pricing error or market manipulation through normal trading activity. The protocol has since paused trading while the investigation continues. Users have been advised to follow Ostium’s official communication channels for updates on withdrawals and any further recovery measures. Update: All trader funds and open positions are currently preserved as-is (frozen). Funds in the trading storage contract are paused. The team is actively investigating with relevant security experts. We will provide updates as they come. https://t.co/zDe8gapmS3— Ostium (@Ostium) July 15, 2026 Institutional backing failed to prevent another security setback Before the exploit, Ostium had raised about $27.8 million from investors including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute and GSR. The incident occurred despite the project’s institutional backing and multiple security audits, highlighting that infrastructure outside audited smart contracts can still become a critical point of failure. The attack also adds to a series of recent security incidents affecting crypto platforms. Earlier this month, crypto.news reported that Ctrl Wallet announced it would permanently shut down after a separate security exploit affecting some Cardano wallets. The company gave users until Aug. 3 to move their crypto assets before wallet functions, including sending, receiving and swapping, are disabled, leaving only recovery phrase exports available. Elsewhere in the Arbitrum ecosystem, Secret Network recently proposed migrating its SCRT token from Cosmos to Arbitrum, citing security concerns, weaker liquidity and aging code on its current network. The proposal includes a one-time Sept. 1 snapshot that would distribute a new ERC-20 SCRT token on Arbitrum to eligible native and staked SCRT holders. As projects continue expanding onto Arbitrum, the Ostium exploit demonstrates that securing oracle infrastructure remains as important as auditing smart contracts. According to Blockaid’s findings, a single compromised signer key was enough to bypass trusted price verification and inflict multimillion-dollar losses within hours.
