Ostium Platform Loses $18 Million in Sophisticated Pricing Exploit
Exploiting Internal Infrastructure
A fabricated price arrived with a futuristic timestamp. This allowed a malicious actor to turn ordinary transactions into incredibly profitable trades. Consequently, the attacker siphoned roughly $18 million from the decentralized platform Ostium. They successfully stole these USDC stablecoin funds directly from the project’s liquidity vault. This vault operates seamlessly on the Arbitrum network. Security experts at Blockaid initially discovered the attack.
To extract the funds, the perpetrator cleverly utilized Ostium native infrastructure. First, they gained unauthorized access to the registered PriceUpKeep component. Through this module, the attacker transmitted forged pricing data featuring futuristic timestamps. The platform mistakenly accepted this false information as authentic. Therefore, the system incorrectly calculated that the open positions yielded massive profits. You can view the on-chain details in this Arbitrum transaction record.
Automated Smart Contract Drain
Following this deception, the smart contracts automatically disbursed roughly 18 million USDC to the attacker. In reality, the actual value of the underlying assets never increased. The immense profit existed solely within the platform’s distorted internal calculations.
Understanding the Ostium Ecosystem
Ostium empowers users to trade commodities, currencies, and market indices with remarkable 200x leverage. To determine accurate asset values, the project relies on a bespoke pricing data system. Specifically, the third-party Gelato automation network feeds live prices into the blockchain. Meanwhile, the PriceUpKeep contract diligently records these current values just before executing trades. Before this unfortunate breach, Ostium had successfully secured $27.8 million in total investments. This impressive funding included a substantial $24 million round in late 2025. Following its launch, the platform facilitated trading volumes exceeding a staggering $50 billion.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
