The on-chain perpetual contracts platform Ostium suspended its trading after suffering an attack that resulted in the loss of about US$ 18 million in USDC. The flaw hit the exchange’s OLP vault on the Arbitrum network and led the team to temporarily halt operations while it investigates the incident.
According to blockchain security firm Blockaid, the attacker exploited a vulnerability related to the platform’s pricing system. The initial analysis indicates that the attacker managed to manipulate authorized oracle data to create artificial profits and withdraw millions of dollars from the vault.
According to Blockaid, the attacker "used a registered PriceUpKeep forwarder and authorized future-dated oracle reports to create artificial trading profit, triggering a payout of approximately US$ 18 million in USDC from the vault".
After identifying the problem, Ostium confirmed the immediate suspension of operations through a post on the social network X.
"We are aware of the issue with the OLP vault. We have suspended all trading. The team is investigating."
Data recorded on the blockchain show that part of the USDC obtained in the attack began to be converted into Ethereum using Kyber Network. Next, the assets were distributed among different wallets, a move that normally occurs to make it harder to trace the funds.
The incident comes just a few weeks after Ostium announced a partnership with Nasdaq to offer perpetual contracts products linked to the stock market. At the time, the company also said it had surpassed the US$ 50 billion mark in cumulative trading volume, consolidating its presence among DeFi protocols focused on derivatives.
Founded by Kaledora Kiernan-Linn and Marco Antonio Ribeiro, both Harvard alumni, Ostium has already raised US$ 27,8 million in investments. Among its main backers are General Catalyst, Jump Crypto, LocalGlobe, Susquehanna, and Alliance DAO. While the investigations continue, the platform remains with trading suspended to assess the impacts of the attack and implement measures to protect its users and its infrastructure.
