1 hour ago
A hacker utilized Ostium's ain price-reporting infrastructure against the protocol, submitting falsified future-dated oracle information to manufacture fake trading profits and trigger an $18 cardinal payout.
Hacker (Pixabay)- An attacker exploited a registered constituent of Ostium's price-feed automation system, submitting oracle reports with manipulated aboriginal timestamps to marque losing trades look profitable — triggering an $18 cardinal USDC payout from the protocol's vault.
- The onslaught follows a drawstring of akin keeper and oracle exploits successful DeFi, including a $6 cardinal drain from Summer.fi past week, highlighting persistent vulnerabilities successful the automated infrastructure protocols trust connected to bring real-world terms information onchain.
- Ostium, a perpetuals speech connected Arbitrum focused connected real-world assets similar gold, forex, and equity indices, had raised $27.8 cardinal successful backing and processed implicit $50 cardinal successful trading measurement earlier the incident.
An attacker drained astir $18 cardinal successful USDC from Ostium's liquidity vault connected Arbitrum successful an oracle manipulation exploit detected by blockchain information steadfast Blockaid, onchain data shows.
According to Blockaid's alert, the attacker leveraged a registered PriceUpKeep forwarder, a constituent of Ostium's automated infrastructure, to taxable oracle terms reports with future-dated timestamps. The manipulated reports created the quality of profitable trades, which triggered an $18 cardinal USDC payout from the vault.
Ostium is simply a decentralized perpetuals speech connected Arbitrum that allows users to commercialized real-world assets including commodities, forex, and equity indices, with up to 200x leverage, settling successful USDC.
Ostium uses a customized price-feed strategy to way real-world plus prices, with a third-party automation web called Gelato liable for pushing those prices onchain astatine the close moments. A astute declaration called PriceUpKeep sits astatine the halfway of that process, acting arsenic the trigger that writes the latest terms information to the blockchain whenever a commercialized needs to beryllium executed.
The onslaught is accordant with a signifier of oracle and keeper-system exploits seen crossed DeFi successful caller years, the astir caller of which saw $6 cardinal drained from Summer.fi past week. The exploit involves attackers gaining entree to privileged roles and manipulate the timing oregon contented of terms information to extract funds from liquidity pools.
Ostium had raised $27.8 cardinal successful full funding, including a $24 cardinal Series A co-led by General Catalyst and Jump Crypto successful precocious 2025, and had processed implicit $50 cardinal successful cumulative trading volume.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
CEX trading volumes roseate for the archetypal clip successful 5 months successful June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a grounds $311B.
CEX trading volumes roseate for the archetypal clip successful 5 months successful June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a grounds $311B.
Why it matters:
CEX trading volumes roseate for the archetypal clip successful 5 months successful June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a grounds $311B.
English (US) 