The Ostium crypto theft saw attackers steal $23.75 million from the platform’s liquidity provider vault after compromising off-chain infrastructure used to supply price data.
According to Ostium, the attackers submitted fraudulent price reports that appeared legitimate. They then quickly opened and closed large trading positions at manipulated prices, creating artificial profits and draining funds from the liquidity vault.
The platform said ordinary trader collateral was held in a separate smart contract and was not affected. Existing positions also remain open, although trading is still paused.
Attackers Manipulated Off-Chain Price Feeds
Ostium is a decentralised trading platform built on Arbitrum. It allows users to trade on the price movements of crypto and traditional assets directly from a cryptocurrency wallet.
The protocol relies on external price feeds to provide market data, while transactions are settled in USDC.
The Ostium crypto theft did not involve a direct compromise of the platform’s trader collateral contract. Instead, attackers targeted off-chain systems that feed prices into the protocol.
By submitting manipulated reports, they were able to make trades appear profitable and withdraw funds from the liquidity provider vault.
Ostium first disclosed a security incident on 16 July, when it paused trading across the platform. The company said it had informed relevant authorities and was tracking the stolen funds.
Stolen USDC Was Converted to Ethereum
Blockchain security firm PeckShieldAlert reported that the attacker swapped the stolen USDC for approximately 12,080 Ethereum.
It said that around 10,540 Ethereum was then deposited into Tornado Cash, a cryptocurrency mixer often used to obscure the movement of digital assets.
Ostium has not provided further technical details about the compromised off-chain infrastructure. However, it said it is working to secure the affected systems and determine the next steps for liquidity providers.
Trader Collateral Was Not Affected
The platform stressed that collateral posted by traders for leveraged positions was stored separately from the liquidity provider vault.
As a result, the Ostium crypto theft did not affect trader collateral. Long and short positions were also not automatically closed or liquidated.
However, those positions are currently frozen because Ostium halted all trading within 60 minutes of the first exploit transaction.
Ostium Trading Remains Paused
Five days after the incident, trading on Ostium remains suspended.
The company said it will give users at least 24 hours’ notice before trading resumes. When the platform reopens, existing positions will be marked to the market price at that time.
For now, Ostium’s priority is securing its price infrastructure and establishing a recovery plan for affected liquidity providers.
0 responses to “Ostium Crypto Theft Drains $23.75 Million From Liquidity Vault”