Ostium Perp DEX Hit for $18 Million in Brutal Oracle Exploit

Arbitrum’s RWA perpetual platform Ostium lost nearly $18 million USDC today after attackers compromised an oracle signer key and manipulated prices.

The root cause was a compromised oracle signer private key. This allowed the attacker to bypass verification checks and submit favorable future prices. They executed around 20 looped trades through delegated actions, instantly profiting at the protocol’s expense without genuine market exposure.

Exploit Drains One-Third of Vault in Hours

Security firm Blockaid first flagged the incident on July 15, 2026. The attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to generate artificial trading profits. This triggered repeated open-and-close loops that drained funds from Ostium’s main liquidity vault.

Follow us on X to get the latest news as it happens

On-chain data shows roughly $11.86M–$18M USDC extracted from the vault, representing about 32-35% of its ~$34M TVL at the time of the attack. The primary exploit transaction is publicly verifiable on Arbiscan.

Ostium is a leading decentralized perpetuals exchange focused on real-world assets — equities, commodities, forex, and indices — built on Arbitrum.

Major Backing Meets Major Setback

The protocol had raised approximately $27.8 million from top-tier investors including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR. Despite strong institutional support and multiple audits, the incident exposes persistent risks in oracle-dependent RWA infrastructure.

The exploit is under active investigation. Users should monitor official channels for withdrawal guidance and security updates. The event underscores the need for hardened oracle key management and real-time monitoring in hybrid DeFi protocols.

As the RWA perpetuals sector grows rapidly, this breach serves as a timely reminder: even well-funded projects remain vulnerable to private-key and oracle attacks. Expect increased scrutiny on similar platforms in the coming weeks.

The post Ostium Perp DEX Hit for $18 Million in Brutal Oracle Exploit appeared first on BeInCrypto.