Ostium Identifies Off-Chain Breach as Source of $23.75M Exploit

The investigation revealed that the breach originated from unauthorized access to systems responsible for submitting price data. By abusing recognized forwarder paths, the attacker pushed fraudulent reports that appeared legitimate to the protocol’s verification process. A initial test transaction of 100 USDC yielded roughly 897.8 USDC in artificial profit, signaling the feasibility of the attack. Following this, the perpetrator executed a primary transfer of 11.9 million USDC, eventually repeating the cycle until the total loss hit 23.75 million USDC.

Blockaid, which provided early analysis of the event, noted that the attacker utilized a compromised oracle signer private key to force these manipulated reports through a registered PriceUpKeep forwarder. This method effectively turned the protocol’s own price-tracking mechanisms against it, siphoning funds from the OLP liquidity vault while keeping trader collateral in separate, secure trading contracts. Automated monitoring systems eventually flagged the abnormal activity, forcing a halt to trading and allowing the team to migrate to a more secure production environment by July 23. While the protocol continues to finalize a recovery plan for affected liquidity providers, the incident highlights the mounting risks associated with the off-chain infrastructure supporting decentralized finance.