Ostium Arbitrum DEX loses $18 million in oracle exploit

A major decentralized finance protocol has been exploited, resulting in the loss of millions of dollars from its core vault. The attack targeted Ostium, a perpetual futures exchange built on the Arbitrum network, with security firms estimating losses of approximately $18 million in the USDC stablecoin on July 15, 2026.

The exploit was executed by compromising a private key controlling an oracle signer, a privileged component responsible for submitting price data to the protocol. According to security firm Blockaid, the attacker used this access to submit falsified, future-dated price reports through a registered component of Ostium's system called a PriceUpKeep forwarder. These manipulated reports created the appearance of profitable trades, which the protocol's settlement vault then paid out in USDC.

Ostium confirmed the incident on social media, stating the team was aware of an issue with its OLP vault and had paused all trading while an investigation is underway. The protocol has not released an official statement on the total amount lost. While Blockaid's figure of $18 million is widely cited, other security firms reported varying amounts, with some noting a specific...