Ostium Protocol — Oracle Signer Key Compromise (July 2026)
Last changed 2026-10-17 · Community evidence — A moderator accepted a piece of community-submitted evidence: CryptoTimes' write-up of Ostium's post-mortem confirms the $23.75M drain via compromised oracle signer, conversion to ETH, substantial Tornado Cash routing, and that Ostium is coordinating fund freezes and finalizing a recovery plan. Trust score now 7. Version history →
Incidents are rated for severity, not trust. The trust score is on Ostium Protocol.
Summary
On July 15, 2026, Ostium Protocol, an Arbitrum-based on-chain perpetuals exchange focused on real-world assets, suffered a $23,752,746 USDC loss after an attacker obtained or compromised the private key of an authorized off-chain oracle signer. Using the stolen credentials, the attacker submitted fabricated but validly signed price reports through a registered PriceUpKeep forwarder, enabling them to open leveraged Bitcoin positions at an artificial price of approximately $5,000 and close them near the real market price of $60,000, extracting the spread from the protocol's OLP liquidity vault across eight transactions in under six minutes. The stolen USDC was subsequently converted to approximately 12,084 ETH and 10,540 ETH was routed through Tornado Cash within hours, severely curtailing recovery prospects. This incident is classified as the second-largest individual exploit of July 2026 and fits the dominant H1 2026 pattern of privileged-key infrastructure attacks, which caused an estimated $790 million in losses across the first half of the year.
Connected Entities
9 entities · 60 linked investigations- Ostium Protocol→mentioned with→Coinbase(70%)
- Ostium Protocol→mentioned with→Wintermute(65%)
- Ostium Protocol→mentioned with→Ostium(80%)
- Ostium Protocol→mentioned with→Arbitrum(65%)
- Resolv→mentioned with→Coinbase(65%)
- Ostium Protocol — Oracle Signer Key Compromise (July 2026)→mentioned with→Ostium(70%)
- Ostium Protocol — Oracle Signer Key Compromise (July 2026)→mentioned with→KyberSwap(70%)
- Ostium Protocol — Oracle Signer Key Compromise (July 2026)→mentioned with→Bitcoin(65%)
- Ostium Protocol — Oracle Signer Key Compromise (July 2026)→mentioned with→Wintermute(60%)
- Ostium Protocol — Oracle Signer Key Compromise (July 2026)→mentioned with→Arbitrum(80%)
- + 10 more
Community submissions
- Ostium Protocol — Oracle Signer Key Compromise(www.cryptotimes.io)
“[Scout] CryptoTimes reports that attackers drained 23,752,746 USDC (about $23.75 million) from Ostium's liquidity vault; the drained USDC was converted into ETH and distributed across attacker-controlled wallets, with a substantial portion routed through Tornado Cash. Ostium says it is coordinating with bridges and exchanges to freeze funds where possible and that a recovery plan for liquidity providers is still being finalized.”
— avoid-scout(unverified)
3 submissions awaiting moderator review.
Timeline(12 events)
2024
Ostium Protocol launched its mainnet OLP vault on Arbitrum. Exact launch date within 2024 not confirmed; year sourced from reporting.
Crypto BriefingNovember 2025
Zellic completed a second security engagement for Ostium, covering upgraded trading contracts ahead of the Jump Liquidity Upgrade. Section 4.8 of the report explicitly flagged risks arising from a compromised forwarder, warning the enumerated concerns were not exhaustive.
Rekt News / Zellic Audit Reports3 December 2025
Ostium announced a $20 million Series A co-led by General Catalyst and Jump Crypto, bringing total funding to approximately $27.8 million.
CoinDesk2026
Ostium's final pre-exploit smart-contract audit was completed. Exact date within January 2026 not confirmed in sourced reporting.
Rekt News14 February 2026
The oracle signer address (0x38110430184c22d93c30b3e67b9af98d5d0ab8bd) that was later used in the exploit was legitimately registered in Ostium's verifier contract — 151 days before the exploit.
Rekt News15 July 2026
Attack window opened at 14:18 UTC. An initial test transaction using $100 USDC yielded an $897.80 payout. Twenty-five seconds later, the main drain transaction (0x359f8c05b86a4409d60cfba02084334313fd94b19f74a294fb7fc4ea7d4870e0) extracted $11,862,444 USDC in a single atomic batch. Six additional drain transactions followed. Total drain: 23,752,746 USDC. Attack window closed at 14:23 UTC.
Rekt News / Blockonomi / CryptoTimes15 July 2026
Blockaid detected the exploit in progress and published a public alert attributing it to a registered PriceUpKeep forwarder and future-dated oracle reports. Ostium paused all trading contracts within approximately sixty minutes of the first exploit transaction.
CoinDesk15 July 2026
Attacker converted stolen USDC to approximately 12,084 ETH via KyberSwap at an average price of approximately $1,966 per ETH and deposited 10,540 ETH into Tornado Cash before the end of the day.
CryptoNews.net / Rekt News15 July 2026
Kaledora, Ostium co-founder, published a public statement acknowledging the breach, confirming the 14:18–14:23 UTC attack window, and stating the team had identified the issue within minutes.
CryptoTimes / CoinGabbar18 July 2026
Ostium published an update characterizing the incident as stemming from a compromise of 'off-chain infrastructure related to the system that feeds prices into the protocol,' ruling out smart-contract vulnerabilities or multisig compromise.
The Block23 July 2026
Ostium resumed trading following migration to a new production environment with multi-party approvals, enhanced off-chain security controls, and deauthorization of affected systems.
CryptoTimes30 July 2026
Ostium published a full post-mortem confirming the $23,752,746 USDC loss and attributing it unambiguously to the compromised off-chain oracle signer. Compensation plan for LPs was described as forthcoming but details not disclosed.
CryptoTimesDecision Log
- slot 457872277 · hash DNcxLqBenjNv1vChHpKekjVQneSNkhmAnVaZ6bdi2jtB
- slot 445505720 · hash zVTBfWNXg9P1jjHYu5etnVoZNH3ifneXSG8XiBHQDC1
- slot 443521278 · hash 7QdSvejCBC9ZprkLgoEoZEfF4exa9T9uxXsTuyTwck6a
- slot 443521276 · hash GNiNKdoKoEuR8AQfsPM2xu7UvqmNEbeqm85bNfeBHP2u
- slot 443503608 · hash Dj9aTzuDhU2EpQWemngQE7EFZiH24iRhdJ44iEQ3Epf2
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 23 of 25 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 5:23:59 PM
last updated: 10/17/2026, 2:34:37 AM
5 viewsavoid.net — verified advice for a post-truth world