Ostium hit by oracle report exploit as five-minute incident drains up to $24 million

Onchain perpetuals platform Ostium said a five-minute security incident hit its public Ostium Liquidity Provider, or OLP, vault on July 15 between 14:18 and 14:23 UTC. Third-party security firms said the issue was not a missing signature. Instead, they said a registered PriceUpKeep forwarder submitted authorized oracle reports carrying future timestamps, which then generated false trading profits. Public loss estimates vary. Blockaid put the payout near $18 million, Cyvers estimated $23.7 million, and PeckShield later said about $24 million had been drained. SlowMist cited a lower figure of $11.86 million, apparently based on a visible vault outflow of 11,862,444.782 USDC in a referenced transaction. Ostium co-founder Kaledora Kiernan-Linn said the team detected the issue within minutes and coordinated a trading pause within an hour. She also said the protocol is working with law enforcement, SEAL 911, and outside security experts. Ostium has not yet published a final loss total, root-cause analysis, or post-mortem report. The case differs from Bonzo Lend’s recent Hedera incident, where the validator reportedly accepted a proof without a valid signature. In Ostium’s case, security firms said authentication passed, but the data itself was unsafe.