Ostium Says Off-Chain Breach Enabled $23.75M USDC Drain

Overview

• The attacker used compromised off-chain reporting systems to submit fake BTC‑USD prices that generated artificial trading profits and drained 23.75 million USDC from Ostium’s public OLP liquidity vault.
• Ostium says the exploit began with a small 100 USDC test position and escalated into a main transfer of about 11.9 million USDC followed by six additional exploit cycles that together produced the total loss on July 15.
• The protocol’s automated monitoring detected abnormal activity, trading was halted during the investigation, operations were migrated to a hardened production environment, and trading resumed on July 23.
• Ostium’s post-mortem found no flaws in its smart contracts or evidence that governance multisigs were compromised and confirmed that trader collateral and user margin inside trading contracts were not affected.
• Industry analysts say the incident highlights wider risks in signer key management, forwarder paths and oracle infrastructure and Ostium is finalizing a recovery plan that it will publish for affected liquidity providers.