On July 15, 2026, Ostium’s liquidity provider vault was drained of 23,752,746 USDC in a five-minute attack that bypassed every on-chain safeguard. The exploit did not touch a single line of Solidity code. Instead, it turned the protocol’s own price-reporting infrastructure into a payout machine, forcing a week-long trading halt and leaving liquidity providers to absorb the loss.
Ostium is a decentralized perpetuals exchange on Arbitrum that lets users trade real-world assets and crypto pairs from a self-custodial wallet. Its settlement engine relies on signed price reports from an off-chain oracle system. A Verifier contract checks that each report carries a valid signature from an authorized signer before the Trading contract acts on it. That signature check was the entire gate — and it held. The problem was that the gate let through a perfectly valid signature attached to a completely fabricated price.