Ostium hack — July 2026

On 15 July 2026, between roughly 14:18 and 14:24 UTC, an attacker drained 23,752,746 USDC from the OLP liquidity vault of Ostium, an Arbitrum-based perpetuals exchange for commodities, foreign exchange and equity indices.

Ostium settles trades against prices pushed on-chain by its own off-chain reporting system. The attacker obtained unauthorised access to that infrastructure and submitted fraudulent BTC/USD price reports through forwarder paths the protocol already trusted, so the contracts accepted them as legitimate. Opening a position against one fabricated price and closing it against another produced profit the vault then paid out. Ostium's post-mortem describes a 100 USDC test position that generated about 897.8 USDC of artificial profit, a main batch that moved 11.9 million USDC to the attacker's wallet, and six further standalone cycles. Reporting on the attack described fabricated bitcoin quotes around $5,000 being used to open positions. Automated monitoring detected the activity and blocked further withdrawals, and trading contracts were paused within the hour.

Ostium stated it found no evidence of a vulnerability in its smart contract logic and no compromise of the multisigs governing the protocol. Trader collateral was untouched and user margin remained in the trading contracts; the loss fell on the vault's liquidity providers. The protocol migrated to a new production environment and reopened trading on 23 July. A recovery plan for liquidity providers was still being finalised.

Published figures differ. Blockaid, which flagged the exploit on the day, put the drain at about $18 million, and that number circulated widely. Ostium's later post-mortem gave the exact vault figure of 23,752,746 USDC. Researchers noted the PriceUpKeep component involved was excluded from the protocol's bug bounty scope.