Ostium loses $23.75 million after attackers feed the platform fake prices

Key points

• Ostium, a decentralised trading platform, lost $23.75 million from its liquidity vault after an attack disclosed on July 16, 2026.
• Attackers fed the platform false prices from outside and cashed in on the fake moves, without touching the trading contracts themselves.
• Ordinary traders' deposits were held in a separate contract and were not stolen, though their positions are frozen while trading stays paused.
• Blockchain trackers at PeckShield say the thief swapped the stolen funds into 12,080 Ethereum and pushed 10,540 of those coins through Tornado Cash, a service that obscures where crypto came from.
• Ostium halted all trading within 60 minutes of the first bad transaction and has promised a full technical write-up.

Ostium, a trading platform that lets people bet on the price of stocks, gold or crypto using a cryptocurrency wallet, has confirmed attackers walked off with $23.75 million last week.

The money came out of what Ostium calls its liquidity provider vault: a shared pool of funds deposited by users hoping to earn a yield, which the platform uses to pay out winning trades.

The attackers didn't pick the lock on the vault itself. They went after the thing telling the vault what prices to use.

How did the hackers actually pull this off?

They lied to the platform about prices, and the platform believed them.

Ostium runs on Arbitrum, a network built on top of Ethereum to make crypto transactions cheaper and faster. Trades are settled in USDC, a digital dollar designed to hold a steady value of one US dollar per coin.

To know what gold is worth at any moment, the platform pulls data from an outside price feed running on normal servers rather than on the blockchain itself. Ostium calls this "off-chain infrastructure", and that's the piece that got compromised.

The attackers submitted fake price reports dressed up to look real, then opened large positions, waited for the fake move to register as profit, and closed them. Repeat until the vault was empty.

This is the classic oracle manipulation failure. The smart contract code did exactly what it was told. It was told nonsense.

What happened to the money?

Blockchain security firm PeckShield traced the stolen USDC as it was swapped for 12,080 Ethereum. Of that, 10,540 Ethereum was pushed into Tornado Cash, a mixing service that scrambles the trail between sender and receiver.

Once funds go through a mixer, recovery becomes very difficult. The working assumption inside the industry is that this money's gone.

Did ordinary traders lose their deposits?

No, according to Ostium.

Collateral posted by regular users sits in a separate smart contract that wasn't touched. Open long and short positions weren't force-closed or liquidated.

Those positions are effectively frozen. Trading was paused across the whole platform within 60 minutes of the first bad transaction, first reported by BleepingComputer, and it's still paused five days on.

Ostium says it'll give at least 24 hours' notice before trading reopens. When it does, positions will be marked at the reopening price, so users will see gains or losses based on where the market moved while the platform was dark.

Should you worry about your funds?

If you have funds or open trades on Ostium, watch the platform's official channels for the promised post-mortem and the notice before trading resumes. Don't click links from strangers offering "recovery services" or "refund forms". Scammers turn up in the replies after every crypto incident.

The post-mortem will almost certainly confirm that the price feed lacked adequate sanity checks. Manipulated oracles, feeds that supply external data to smart contracts, have drained decentralised finance platforms for years, and this failure mode is depressingly familiar. Our 30 June report on the Silent Swap clipper campaign showed a different vector hitting the same target: people trusting an external input they shouldn't.

Operational takeaway: if your protocol trusts a single off-chain input, that input is your vault key.