Ostium liquidity vault drained of $23.75 million in price-feed attack
Security & Exploits ·
The perpetuals platform says an attacker manipulated off-chain infrastructure feeding prices into the protocol, extracting funds while trader collateral remained untouched.
Ostium disclosed that its liquidity provider vault lost 23,752,746 USDC on July 15, after an intruder gained access to systems that supply pricing data to the platform, according to a statement posted on X. The team's account of the incident describes the attacker submitting falsified price reports designed to pass as legitimate, then rapidly opening and closing a series of oversized positions to siphon an artificial gain from the vault.
Because trader funds are held in a separate, walled-off contract by design, that collateral was not touched, and existing trader positions have stayed open throughout. The distinction between the compromised liquidity pool and the isolated trader contract appears central to how much damage the exploit was able to inflict.
Response came quickly: within 60 minutes of the first exploit transaction, Ostium says it paused trading and froze all trading contracts. The firm is now working with Mandiant, along with zeroShadow, Collisionless, and SEAL 911, and has looped in law enforcement while coordinating with exchanges, bridges, and stablecoin issuers to track the stolen funds. Current engineering work is focused on isolating and hardening the compromised infrastructure ahead of any relaunch.
Ostium has committed to giving at least 24 hours notice before unfreezing trading contracts, and says positions will be marked to the price at reopening rather than to whatever price movements occur during the freeze. The company also urged users to rely only on official channels, noting it will never initiate direct messages or request private keys, seed phrases, or funds, and has set up a tips line for anyone with information relevant to the investigation.
What remains unresolved is whether the stolen USDC can be recovered, how the attacker obtained access to the price-feed infrastructure in the first place, and how long the hardening process will take before trading resumes. No timeline for relaunch has been given beyond the 24-hour notice commitment.