Today we witnessed another serious incident in the world of decentralized finance. The perpetual contracts platform Ostium, operating on Arbitrum and focused on real-world assets (RWA), lost nearly $18 million in USDC. The cause was a sophisticated attack on the oracle mechanism.
During the investigation, it was discovered that the attacker gained access to the private key of the oracle signer. This allowed them to bypass standard checks and send fake price predictions to the protocol. Using the registered PriceUpKeep forwarder, the hacker executed about 20 recurring transactions through delegated actions, instantly extracting profit by manipulating prices without actual trading involvement.
Instant depletion of the liquidity pool
The attack developed rapidly. Within a few hours, the attacker drained approximately one-third of Ostium's main liquidity pool. According to on-chain analysis, between $11.86 million and $18 million in USDC was withdrawn from the vault, accounting for about 28% of the total value locked (TVL) at the time of the attack, which was estimated at $63 million. The main transaction can be verified via Arbiscan.
Ostium is a major decentralized exchange for perpetual contracts on stocks, commodities, currencies, and indices, making it a notable player in the RWA DeFi segment.
Reputational blow amid major investments
Notably, the project raised approximately $27.8 million from leading institutional investors, including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR. Despite such significant backing and several conducted security audits, the incident revealed a critical vulnerability in the infrastructure of protocols dependent on oracles.
The investigation is ongoing. Users are strongly advised to monitor the project's official channels for instructions on withdrawing funds and security updates. This situation serves as a stark reminder: even well-funded and audited projects remain vulnerable to attacks on private keys and oracles. The sector of perpetual contracts on real-world assets is growing rapidly, and this hack underscores the urgent need for enhanced protection of key infrastructure and real-time monitoring of hybrid DeFi platforms.
My expert opinion: This incident is not just an isolated case but a systemic alarm for the entire RWA DeFi sector. Dependence on centralized or poorly secured oracles is an Achilles' heel that hackers will exploit again. Projects need to rethink their security models by implementing multi-layered data verification and decentralized oracle networks resilient to key compromise.