Ostium has kept trading suspended after an oracle-related exploit triggered an estimated $18 million USDC payout from its OLP liquidity vault on Arbitrum. In a July 16 update, Ostium said existing user positions remain open but cannot be modified. Trader margin remains inside the frozen trading contracts while the protocol investigates the incident and determines how affected positions will be handled.
A Security Update: Trading remains paused following the security incident. User positions remain open and unmodifiable, and trader margin remains unmoved in frozen trading smart contracts. The team will continue to provide updates as they become available regarding a timeline…
— Ostium (@Ostium) July 16, 2026
Future-Dated Reports Created Artificial Profits
Blockchain security firm Blockaid said the attacker used a registered PriceUpKeep forwarder to submit authorized oracle reports carrying future timestamps. The reports caused Ostium to recognize artificial trading profits, triggering an approximately $18 million USDC payout from the OLP vault. It remains unclear how the attacker obtained access to the authorized reporting pathway. The available evidence does not indicate that prices in external stock, commodity or currency markets were changed. Instead, the attacker allegedly manipulated the price information Ostium accepted when processing and settling trades.
🚨 Blockaid detected an @Ostium Vault exploit on Arbitrum.
An attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering a ~$18M USDC payout from the vault.
More details in 🧵— Blockaid (@blockaid_) July 15, 2026
The incident follows the $6 million Summer.fi vault exploit, where manipulated liquidity and accounting conditions allowed an attacker to extract funds from a USDC-focused DeFi vault. The technical methods differ, but both cases show how trusted pricing and settlement assumptions can expose pooled liquidity. Ostium uses external price feeds and automated keeper infrastructure to execute trades, liquidations and conditional orders. However, the protocol has not confirmed whether an oracle signing key, a registered forwarder or another operational component was compromised.
OLP Vault Absorbs Reported Loss
The OLP vault contains USDC supplied by liquidity providers and acts as the counterparty to trades on Ostium. When traders record profits, settlement funds are paid from this pooled liquidity. Because the manipulated reports made the attacker’s positions appear profitable, the resulting payout came from the OLP vault. Ostium’s update indicates that trader margin was held separately and was not moved from the frozen trading contracts.
Ostium is the second Arbitrum-linked platform to halt operations following a vault incident this week. Cascade suspended trading and withdrawals after approximately $1.34 million in USDC left its CLS vault, although the technical cause of that incident remains undisclosed. Ostium has not yet released a final loss reconciliation, compensation plan or detailed post-mortem. The $18 million figure remains Blockaid’s preliminary estimate rather than a final amount confirmed by the protocol. On-chain reports indicate that part of the USDC linked to the exploit was exchanged for ETH through Kyber Network before being divided among multiple wallets.
Exact Access Method Remains Unclear
Some reports have described the incident as an oracle signer-key compromise, but Ostium has not confirmed that explanation. The attacker may have compromised an authorized signer or forwarder, gained access to supporting infrastructure or exploited insufficient timestamp and sequencing checks. There is also no verified evidence that Gelato’s broader automation network was compromised.
Price-dependent DeFi systems have also been targeted through other methods. A recent DLMC flash-loan exploit manipulated the protocol’s internal token price before inflated rewards were redeemed, highlighting how weak pricing controls can turn temporary data distortions into real treasury losses. Ostium has yet to explain how profits, losses, liquidations or other market movements will be applied to positions that users cannot currently modify. It has also not announced when trading will resume or how losses suffered by OLP liquidity providers will be addressed. Trading remains paused while the investigation continues.
