Ostium Halts Trading After $18M Oracle Key Exploit

The Exploit and Trading Halt

Ostium, an Arbitrum-based perpetuals DEX, halted trading after an attacker gained control of a compromised oracle signer key and drained nearly $18 million USDC from its liquidity vault, according to blockchain security firm Blockaid and reporting from Decrypt and CoinDesk. The attacker leveraged unauthorized access to the platform's price-reporting infrastructure to submit falsified future-dated oracle data, manufacturing fake trading profits and triggering the $18 million payout from the vault.

How the Attack Worked

Oracle signer keys authenticate price feeds that DeFi protocols use to execute transactions and maintain system solvency. By compromising this key, the attacker was able to inject false price signals into the system without triggering validation checks. Rather than directly withdrawing funds, the attacker used the forged oracle data to create synthetic trading positions with inflated collateral values, then cashed out the difference from the vault. This method exploited the protocol's trust in its own oracle infrastructure to authorize the transfer.

Immediate Aftermath and Implications

The trading suspension was a precautionary measure to prevent further loss of funds while Ostium's team investigates the key compromise and restores operational security. No formal statement from Ostium had been released as of the latest reporting. This incident adds to a growing wave of oracle-focused attacks targeting DeFi protocols in recent months, demonstrating that single-signer oracle architectures remain a critical vulnerability in production systems.