Ostium Suffers $23.75M Oracle Key Exploit Loss

The decentralized exchange (DEX) Ostium suffered a significant loss of $23.75 million in USDC due to an oracle key exploit on July 15, 2026.

An attacker gained access to an oracle signer private key and used it to create fake profitable trades until the vault ran dry.

Ostium paused trading within an hour of the first malicious transaction and reopened eight days later after a thorough investigation and hardening effort.

The attack targeted the off-chain infrastructure that feeds prices into the protocol, which is often overlooked in audits and bug bounties.

The attacker used a registered PriceUpKeep forwarder to submit future-dated, authorized oracle reports, tricking the protocol into thinking a series of trades were profitable.