In July 2026, Ostium, an Arbitrum-based perpetuals exchange, was the victim of a hack. The protocol fell prey to an oracle manipulation exploit and lost an estimated $18 million (though some estimates run as high as $24 million).
Inside the Attack
The Ostium hack reportedly involved a compromised private key belonging to a price oracle used by the platform. With access to this private key, the attacker could digitally sign fake price reports dated in the future, then push them to the protocol via one of its PriceUpKeep Forwarders.
The attacker exploited the vulnerability by creating fake, artificially low prices for Bitcoin within the BTC/USD trading pair. They opened a position with a fake Bitcoin price of $5,000, then the trade was closed at the real market price of about $60,000. The significant difference between these two price points allowed them to pocket the difference between the perceived and real prices.
The attacker performed this attack in a loop, alternating between initiating a trade and modifying the price via the OstiumPrivatePriceUpKeep function. With ten iterations, the attacker was able to compound the margin used multiple times, eventually generating an estimated 900% profit per round for a profit of over $18 million.
After the hack was complete, the attacker converted the stolen tokens into ETH, and the Ostium team halted trading to address the issue. Researchers pointed out that the exploited component, the PriceUpKeep infrastructure, was explicitly excluded from the scope of the protocol’s bug bounty program, disincentivizing security researchers from identifying and reporting any vulnerabilities for correction.
Lessons Learned from the Attack
The Ostium breach is attributed to a compromised private key that allowed an attacker to submit fake price reports from a trusted oracle. With this access, they could open a synthetic long position at an artificially low price and sell it at market price for a profit. In total, an estimated $18 million was lost this way.
In addition to the potential issues with key management and centralization, this incident also highlighted the importance of comprehensive security coverage for DeFi protocols. The infrastructure targeted by the attacker was intentionally out of scope of the project’s bug bounty program, reducing the amount of scrutiny it would be under.
Comprehensive security testing is important throughout the entire lifecycle of a Web3 project, including on-chain and off-chain security audits and design review. For help with identifying and addressing potential vulnerabilities in your Web3 project, reach out to Halborn.