- Blockaid has detected an Ostium exploit involving future-dated oracle value experiences.
- The attacker used Ostium’s PriceUpKeep forwarder to induce synthetic buying and selling earnings.
- Roughly $18 million USDC was leaked from the protocol’s liquidity vault.
Ostium, a decentralized perpetual change on Arbitrum, suffered a large safety breach ensuing within the lack of roughly $18 million in USDC. Blockchain safety firm Blockaid reported the incident on July 15, 2026, stating that the registration element of Ostium’s value feed automation system was exploited.
In response to Blockaid, the assault leveraged the PriceUpKeep forwarder, a sensible contract used to replace on-chain oracle value information when a transaction is executed. The attacker submitted a report containing a timestamp of a future date. This artificially created the looks of a worthwhile transaction and triggered a big payout from the vault.
Ostium’s value feed system is exploited
Ostium means that you can commerce real-world belongings corresponding to commodities, foreign exchange, and inventory indices with as much as 200x leverage and settle trades in USDC. The platform depends on a customized value feed system. Gelato, a third-party automation supplier, posts asset costs on-chain at scheduled intervals, whereas the PriceUpKeep sensible contract triggers commerce execution updates.
Attackers used this infrastructure to govern the timing and content material of value information. Blockaid famous that these exploits are in line with a sample of oracle and keeper system assaults throughout DeFi, with comparable occasions impacting platforms corresponding to Summer time.fi, which misplaced $6.1 million final week.
On-chain influence and protocol overview
In response to on-chain information, the attackers succeeded in exfiltrating roughly $18 million USDC from Ostium’s liquidity vault. The platform has generated greater than $50 billion in cumulative transaction worth since its launch. Ostium had beforehand raised a complete of $27.8 million in funding, together with a $24 million Sequence A co-led by Normal Catalyst and Bounce Crypto in late 2025.
Ostium permits customers to commerce tokenized derivatives and perpetual contracts on Arbitrum. In response to Blockaid, the exploit highlights vulnerabilities in automated Oracle programs that depend on future-dated experiences and privileged roles.
Traders are suggested to watch official updates from Ostium and BlockAid for verified info concerning restoration measures and asset administration.
Associated: High nations that up to date their digital asset rules to type digital currencies in 2026
Blockaid Report and Business Background
Blockaid’s alert highlighted that the incident entails the abuse of Ostium’s registered PriceUpKeep forwarder. Manipulated oracle experiences created pretend worthwhile buying and selling indicators that allowed attackers to set off payouts.
This occasion is the most recent in a collection of DeFi oracle assaults, highlighting the continuing dangers related to decentralized value feed mechanisms.
Disclaimer: The data contained on this article is for informational and academic functions solely. This text doesn’t represent monetary recommendation or recommendation of any form. Coin Version is just not accountable for any losses incurred because of the usage of the content material, merchandise, or companies talked about. We encourage our readers to do their due diligence earlier than taking any motion associated to our firm.