Onchain perpetuals platform Ostium said a five-minute security incident caused losses in its public Ostium Liquidity Provider, or OLP, vault, with outside security firms estimating the impact at as much as $24 million.
Ostium co-founder Kaledora Kiernan-Linn said the issue took place on July 15 from 14:18 to 14:23 UTC and affected the public OLP vault. She said the team detected the problem within minutes and coordinated a trading pause within an hour. The statement did not include an exact final loss figure, a root cause, or a completed post-mortem report.
Security firms say the problem was authorized data, not a missing signature
Blockaid and Cyvers said the incident centered on authorized data rather than absent signatures. According to their account, a registered PriceUpKeep forwarder submitted authorized oracle reports carrying future dates, creating false trading profits.
SlowMist said an authorized signer supplied manipulated data with valid signatures and that the data was used for repeated profitable trades. Those findings remain third-party observations for now and still need confirmation in an Ostium post-incident report.
Cryptographic authentication can confirm that a report was signed by an allowed key. It does not, by itself, guarantee that the price is reasonable, that the timestamp is fresh enough, or that settlement is safe. Those controls need to be enforced separately.
Verifier code checked signer authorization but did not enforce price sanity or timestamp bounds
The OstiumVerifier code linked from Ostium’s security documentation appears to recover the ECDSA signer and check whether that signer is authorized. The verification function itself, however, does not appear to enforce price sanity checks or timestamp boundaries.
The code also does not clearly identify which implementation version was active during the incident, or whether separate contracts applied those checks elsewhere. If timestamp, replay, price-deviation, or multi-source protections were in place, they would have had to operate at other points in the execution path.
OLP vault structure left public liquidity covering onchain payouts
Ostium’s protocol documentation says the OLP vault holds trader collateral and pays winning trades instantly onchain. If false profits were accepted for settlement, the vault’s liquidity would have funded those payouts.
Public estimates rose as tracking continued. Blockaid said the payout was close to $18 million. Cyvers estimated $23.7 million. PeckShield later described roughly $24 million as drained.
SlowMist posted the lower $11.86 million figure, which appeared to track a visible outflow of 11,862,444.782 USDC from the vault in the transaction it cited.
USDC was swapped into ETH, with part of it sent to Tornado Cash
PeckShield said the withdrawn USDC was exchanged for 12,080 ETH. By the time of its update, 10,540 ETH had moved into Tornado Cash.
Kiernan-Linn said Ostium is working with law enforcement, SEAL 911, and third-party security experts.
Case differs from Bonzo Lend’s recent Hedera incident
The report drew a contrast with a similar issue at Hedera lending protocol Bonzo Lend four days earlier. Bonzo’s incident report said its validator accepted a proof without a valid signature. In the Ostium case, security firms said the report passed through the authorized signer path: authentication succeeded, but the data itself was allegedly unsafe.
Ostium still needs to confirm whether the signer key was compromised, whether an authorized operator acted maliciously, or whether another privileged path was abused.
The effectiveness of any remediation will depend on whether signer isolation, strict timestamp bounds, independent price checks, rate limits, and circuit breakers can stop a trusted path from turning a few minutes of bad data into another vault payout.