Today, Ostium, a decentralized platform for trading perpetual contracts on real-world assets (RWA) operating on Arbitrum, was targeted in a direct attack. As a result of the incident, nearly $18 million in USDC was drained from the project's liquidity pool, representing approximately 28% of the total value locked (TVL), which stood at $63 million at the time of the attack.
The root cause of the issue is a compromised private key of the oracle signer. By gaining access to this key, the attacker was able to bypass the protocol's standard checks and submit fake price forecasts, authenticated by the authorized oracle. Using the registered PriceUpKeep forwarder, the hacker submitted future reports to the protocol, allowing them to artificially manipulate prices to generate instant trading profits.
The attack was carried out through a series of approximately 20 repetitive transactions via delegated actions. Each cycle involved opening and closing positions, ultimately leading to the complete depletion of the main liquidity pool. According to on-chain analytics, the primary withdrawal transaction has already been recorded on the blockchain and is available for verification via Arbiscan.
A Severe Blow to a Promising Project
Ostium is not just another DeFi protocol. It is an ambitious platform that attracted approximately $27.8 million from leading institutional investors, including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR. Despite this strong backing and conducted security audits, the incident has exposed a fundamental vulnerability in the infrastructure of RWA protocols, which critically depend on oracles.
The investigation is ongoing. Users are strongly advised to monitor Ostium's official channels for instructions on fund withdrawals and security updates. This case serves as a stark reminder that even the most well-funded projects remain vulnerable to attacks on private keys and oracles.
Expert opinion: The attack on Ostium is a classic example of how a single point of failure in the form of an oracle signer's private key can nullify all audit and security efforts. The RWA and perpetual contracts sector is growing rapidly, and this incident underscores the urgent need for more robust protection of oracle keys and the implementation of multi-layered real-time verification systems. Without this, trust in hybrid DeFi platforms will remain fragile.