Ostium Loses $23.75M USDC After Price Oracle Infrastructure Breach

Ostium said its liquidity provider vault was compromised on July 15, leading to a loss of 23,752,746 USDC. Based on initial findings, the attacker penetrated the offchain infrastructure that supplies price data to the protocol and pushed manipulated price feeds. The falsified data allowed the attacker to rapidly open and close oversized positions and siphon artificially generated profits from the vault. Ostium said trader collateral is held in separately isolated smart contracts and was not impacted. All open positions remain active. The team halted trading and froze all trading contracts within 60 minutes of the first malicious transaction. Ostium is working with Mandiant, zeroShadow, Collisionless, and SEAL 911, as well as law enforcement, and is coordinating with exchanges, bridge contracts, and stablecoin issuers as the investigation progresses. Engineering teams are repairing and hardening the affected infrastructure ahead of a secure restart. Ostium said it will provide at least 24 hours' notice before unfreezing trading contracts. When trading resumes, existing positions will be marked at the reopening price and will not reflect price movements during the suspension.