Ostium vault on Arbitrum hacked for $18 million in USDC

The RWA perpetual trading protocol Ostium has fallen victim to a major exploit on the Arbitrum network. Security firm Blockaid detected the attack and reports that an attacker managed to siphon approximately $18 million in USDC from the Ostium Vault through a clever scheme. All trading on the platform has been halted while the team conducts an investigation.

Ostium is no stranger to hacks in the DeFi world, but this attack stands out for its technical sophistication. The protocol focuses on perpetual trading of real-world assets such as stocks, commodities and forex markets. Ostium previously raised approximately $27.8 million from investors including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute and GSR.

How the attack worked

The attacker made use of a registered PriceUpKeep forwarder in combination with future-dated authorised oracle reports. By skilfully combining these two elements, the attacker generated artificial trading profits that the system considered legitimate. The result: the vault automatically paid out approximately $18 million in USDC to the attacker.

Blockaid has made public both the exploit transaction and the attacker’s address. The investigation into the incident is ongoing. Attacks involving oracle manipulation are common in the DeFi world, as previously seen in the hack on LayerZero executor wallets that stole $24 million.

Trading halted, investigation ongoing

Ostium itself has acknowledged being aware of a problem with the OLP Vault. As an immediate measure, the team has paused all trading on the platform until it is clear what went wrong and the true extent of the damage.

The exploit affects the Arbitrum network, which has frequently made headlines recently due to activity from both legitimate projects and malicious actors. The payout consists of USDC stablecoins, making the impact on vault liquidity significant. Further details about the attack are expected to follow in a comprehensive post-mortem report from Blockaid.