Ostium, a decentralized perpetuals exchange on Arbitrum, has been drained of approximately $18 million in USDC in an oracle manipulation attack. The exploit, detected by blockchain security firm Blockaid, involved the attacker submitting falsified future-dated price reports to make losing trades appear profitable, triggering a payout from the protocol's vault.
How the Attack Worked
The attacker exploited a registered component of Ostium's price-feed automation system called the PriceUpKeep forwarder. This smart contract is responsible for triggering the onchain recording of price data from real-world assets such as gold, forex, and equity indices. By submitting oracle reports with manipulated future timestamps, the attacker manufactured fake trading profits that caused the vault to release $18 million in USDC.
Ostium relies on Gelato, a third-party automation network, to push price data onchain at the right moments. The PriceUpKeep contract sits at the center of that process. Blockaid noted that the attacker had gained access to a privileged role, allowing them to manipulate the timing and content of the price data.
Pattern of Oracle Exploits
This incident follows a string of similar keeper and oracle exploits in DeFi. Just last week, Summer.fi lost $6 million in a comparable attack. The recurring vulnerability lies in the automated infrastructure that protocols use to bring real-world price data onchain. Attackers are increasingly targeting these systems by abusing privileged roles to submit manipulated data.
Ostium had raised $27.8 million in total funding, including a $24 million Series A led by General Catalyst and Jump Crypto in late 2025. Before the exploit, the platform had processed over $50 billion in cumulative trading volume, offering up to 200x leverage on real-world assets.