Ostium

What happened

Arbitrum perpetuals DEX Ostium suspended trading on 15 July 2026 after an attacker compromised the off-chain infrastructure that signs its price feeds and submitted fabricated Bitcoin quotes, taking 23,752,746 USDC out of the public OLP vault in five and a half minutes.

Between 14:18:23 and 14:23:52 UTC, eight transactions moved 23,753,539 USDC from the Ostium Vault (0x20D419a8) to one wallet, 72.6% of the $32.71m the vault then held. Twenty-four price reports went in through the PrivatePriceUpKeep contract, every one naming BTC/USD at exactly $5,000 or exactly $60,000 while Bitcoin traded near $65,250, and every one timestamped to the block that carried it, so the signing capability was live rather than replayed. Twelve open-and-close rounds each returned 8.987x the stake, Ostium's automatic 900% take-profit ceiling, so the attacker escalated the stake from 100 USDC to 700,000. Trader collateral in the separate storage contract was untouched. Ostium froze trading within 60 minutes, engaged Mandiant, zeroShadow, Collisionless and SEAL 911, and reopened in stages on 23 July; the funds were swapped to about 12,080 ETH with roughly 10,540 ETH sent to Tornado Cash. Deposits remain frozen and the vault's own loss counter still carried $19.2m on 30 July.