Ostium Faces $18 Million Attack Amid Ongoing Oracle Exploits in DeFi

Ostium Faces $18 Million Attack Amid Ongoing Oracle Exploits in DeFi

Ostium, a decentralized perpetuals exchange on Arbitrum, has fallen victim to a significant exploit, losing approximately $18 million in USDC due to an intricate oracle manipulation attack. This incident highlights the persistent vulnerabilities faced by decentralized finance (DeFi) protocols as they navigate ongoing threats.

Details of the Exploit

The attack was executed by submitting falsified future-dated oracle data through Ostium’s own price-reporting system. This manipulation created the illusion of profitable trades, which subsequently triggered the hefty payout from Ostium’s liquidity vault. Blockchain security firm Blockaid identified that the perpetrator utilized a component called PriceUpKeep, part of Ostium’s automated infrastructure, to facilitate this exploit.

Background on Ostium’s Operations

Ostium allows users to trade a range of real-world assets, including commodities, forex, and equity indices, with leverage of up to 200x. The platform employs a custom price-feed system managed by a third-party network known as Gelato. This system is designed to ensure timely updates of asset prices on-chain whenever a trade is executed.

Rising Concerns in the DeFi Sector

This incident is part of a worrying trend observed in DeFi, where similar oracle and keeper-system exploits have occurred repeatedly. Just prior to this incident, another attack resulted in a $6 million loss from the Summer.fi platform. Such events typically involve attackers manipulating privileged roles to alter price data timings or content, enabling them to siphon funds from liquidity pools.

Ostium’s Financial Highlight

Before this exploit, Ostium had raised a total of $27.8 million in funding, including a significant $24 million Series A in late 2025. The platform had also seen considerable trading activity, processing over $50 billion in cumulative trading volume.