Ostium, a decentralized trading platform built on the Arbitrum blockchain, has confirmed that hackers stole $23.75 million from its liquidity provider vault after compromising the platform’s off-chain price feed infrastructure.
In an update shared by the company, Ostium explained that the attackers submitted fraudulent price reports disguised as legitimate data. Using the manipulated pricing information, they quickly opened and closed oversized trading positions to generate illicit profits from the liquidity provider’s vault.
The company emphasized that user collateral remained secure as it is stored in a separate smart contract that was not impacted by the attack. Existing trading positions also remain intact and have not been liquidated.
Ostium allows users to trade both traditional and cryptocurrency-linked assets directly from their crypto wallets. The platform relies on external price feeds for market data, while all transactions are settled using USDC, a stablecoin pegged to the US dollar.
The platform initially disclosed the security incident on July 16, announcing a temporary suspension of trading. At the time, it said that relevant authorities had been informed and that efforts were underway to monitor the movement of the stolen funds.
Providing further details, Ostium said the attackers exploited vulnerabilities in the off-chain infrastructure responsible for supplying market prices to the protocol. The manipulated price feeds enabled them to siphon funds from the liquidity provider vault without affecting trader-held collateral.
According to blockchain security firm PeckShieldAlert, the exploiter converted the stolen USDC into 12,080 Ethereum (ETH) before depositing 10,540 ETH into Tornado Cash, a cryptocurrency mixing service commonly used to obscure transaction trails.
Ostium reiterated that leveraged trading positions are maintained in a separate smart contract, ensuring that customer collateral was not compromised. Although active long and short positions remain recorded on the platform, they are currently frozen following the suspension of trading, which occurred within an hour of the first exploit transaction.
The company said it is focused on securing the compromised infrastructure and evaluating recovery options for affected liquidity providers.
Five days after the breach, trading on Ostium remains suspended. The platform has stated that users will receive at least 24 hours' notice before trading resumes. Once operations restart, all existing positions will be marked to the reopening price.
Ostium also confirmed that it will release a detailed post-mortem report outlining the technical aspects of the exploit in the coming days.