Ostium oracle exploit drains 23.75M USDC from OLP vault; trading resumes 23 July
Ostium says an attacker reached its off-chain systems and submitted false BTC-USD prices. It reports no smart-contract flaw.
· Effective · Verified 2026-10-17 via reputable press
An attacker drained 23.75 million USDC from Ostium's OLP liquidity vault on 15 July 2026 by submitting false BTC-USD price reports, according to Ostium's post-mortem. Trading resumed on 23 July after a migration to a new production environment.
Ostium says the attacker first gained unauthorized access to its off-chain systems, then used forwarder paths the protocol already recognized. Its automated monitoring detected the activity and stopped further withdrawals.
Ostium says it found no evidence of a smart-contract logic flaw or a compromise of its governing multisigs, and that trader margin stayed in its trading contracts. A separate recovery plan for liquidity providers was still being finalized as of the 30 July post-mortem.
“we have no evidence this incident was a result of a vulnerability in Ostium's smart-contract code logic.”
— Ostium post-mortem, via The Block
Who this affects
Liquidity providers in the OLP vault. Ostium says trader collateral was unaffected.
Ostium at a glance
Ostium is an Arbitrum-based perpetuals venue offering leveraged exposure to 75 pairs across stocks, ETFs, commodities, indices, forex and crypto, settled in USDC against a liquidity vault and hedged off-chain with institutional partners.
Full Ostium sheet · 0.06% round trip
More from the newsroom
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- The Block: Ostium blames off-chain breach for $24 million exploit — checked 2026-10-17
- The Block: Ostium pauses trading after apparent vault exploit — checked 2026-10-17
About DexSheet
DexSheet is an independent fee sheet for on-chain trading. It tracks the fees, custody, backers, incidents and availability of 81 crypto trading venues, with a dated source for every number. Every newsroom entry is checked against the venue's own announcement, docs or terms before it is published. Data: fees.json (CC BY 4.0) · RSS.