Ostium Oracle Key Hack Exposes Peril of DeFi's Hidden Infrastructure

Ostium, a perpetual DEX, suffered a major security breach on July 15, 2026, when an attacker exploited a compromised oracle signer private key to drain $23.75 million in USDC from the platform's OLP vault.

The attack involved the use of a registered PriceUpKeep forwarder to submit future-dated, authorized oracle reports, which tricked Ostium into thinking profitable trades were occurring.

The attacker then ran 20 looped open-and-close trades through delegated actions, pulling repeated payouts from the vault without incurring real market exposure.

Ostium immediately paused trading and launched an eight-day investigation with cybersecurity firms Mandiant, zeroShadow, and Collisionless. Trading resumed on July 23 after hardening efforts.