Audit log

Every state-changing event for Ostium Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-29 23:06:16Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   5W47a1VDgKUZ…P8usmGitcopysha256 → base58

   verifying row…

   canonical bytes (23102 B) ▸

   {"actor":"system:backfill","investigation_id":"5723df5c-838e-43a2-a208-bda815ccd91c","kind":"publish","page_slug":"ostium-protocol","published_at":"2026-07-29T23:06:16.421Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ostium Protocol","sections":[{"content":"On July 15, 2026 at approximately 14:18 UTC, an attacker exploited Ostium's off-chain oracle infrastructure to drain $23,752,746 USDC from the protocol's Ostium Liquidity Pool (OLP) vault. The root cause was the compromise of a private key belonging to an authorized off-chain oracle signer, which the attacker used to submit fabricated but cryptographically valid BTC/USD price reports through Ostium's OstiumPrivatePriceUpKeep forwarder contract (0xB71ec9eB...3d36). The primary exploit transaction (0x359f8c05...d4870e0) contained twenty batched calls alternating between Ostium's Trading contract and the OstiumPrivatePriceUpKeep component. In each loop, the attacker opened a BTC long position at an injected price of approximately $5,000 and immediately closed it at or near the real market price of approximately $60,000, collecting the vault-funded difference as profit. All payouts were directed to a fresh externally owned account (recipient: 0x321df194...bfd9) seeded with approximately 1 ETH from ChangeNOW and Bybit prior to the attack. Trading was paused within one hour of the first malicious transaction. The protocol reopened in phases on July 23, 2026 after an eight-day security review, with open positions repriced at live market values to prevent forced liquidations.","heading":"July 2026 Oracle Key Exploit","severity":"critical","sources":[{"credibility":2,"name":"The Ostium Exploit: How a Fake $5,000 Bitcoin Price Drained a Perp DEX","type":"news_article","url":"https://defiprime.com/ostium-exploit"},{"credibility":2,"name":"Ostium Hack: Perp DEX Loses $23.75M in Oracle Key Exploit, Resumes Trading July 23","type":"news_article","url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"credibility":1,"name":"Ostium loses $18 million in oracle attack that gamed its own price-feed infrastructure","type":"news_article","url":"https://www.coindesk.com/business/2026/07/15/ostium-suffers-usd18-million-exploit-as-oracle-attack-wave-continues-to-hit-defi"},{"credibility":2,"name":"Blockaid uncovers $18M exploit that forces Ostium trading halt","type":"news_article","url":"https://crypto.news/blockaid-uncovers-18m-exploit-that-forces-ostium-halt/"}]},{"content":"Following the exploit, the attacker converted the stolen USDC into approximately 12,084 ETH and routed it through Tornado Cash, a cryptocurrency mixing protocol, within hours of the attack. Blockchain analytics firm Galaxy Research traced eight distinct payout transactions to the attacker's single recipient wallet, identifying transfers of $11.86 million, $4.49 million, and $3.59 million among the largest tranches. A separate analysis by Rescana identified approximately 10,540 ETH deposited into Tornado Cash. The use of Tornado Cash significantly limits on-chain traceability and materially reduces prospects for fund recovery. As of late July 2026, all stolen funds remain unrecovered. Ostium pledged to contribute from its own balance sheet alongside partners to compensate affected liquidity providers, but detailed compensation timelines had not been disclosed as of the protocol's July 23 reopening.","heading":"Fund Movements and Laundering","severity":"critical","sources":[{"credibility":2,"name":"Ostium DeFi Platform Breach: $23.75 Million Stolen in Off-Chain Oracle Attack and Credential Compromise","type":"news_article","url":"https://www.rescana.com/post/ostium-defi-platform-breach-23-75-million-stolen-in-off-chain-oracle-attack-and-credential-compromise"},{"credibility":2,"name":"Ostium Hack: Perp DEX Loses $23.75M in Oracle Key Exploit, Resumes Trading July 23","type":"news_article","url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"credibility":2,"name":"Arbitrum bridge not hacked as $24M exploit drains Ostium DEX through oracle manipulation","type":"news_article","url":"https://cryptobriefing.com/arbitrum-bridge-not-hacked-ostium-exploit/"}]},{"content":"Ostium had undergone multiple smart contract security reviews prior to the exploit. Zellic audited the protocol's contracts in early 2024, returning 19 findings including two rated critical, with the price-upkeep and vault contracts in scope. Pashov Audit Group conducted a further review in September 2025. Ostium also listed a ThreeSigma audit, a Chaos Labs economic audit, and an Immunefi bug bounty program. However, none of these reviews substantively addressed the security of off-chain oracle signer key management. Zellic's 2024 engagement expressly placed 'key custody' and 'infrastructure relating to the project' out of scope. The September 2025 Pashov review covered only trading-engine contracts. Critically, Ostium's Immunefi bug bounty program explicitly designated all registered keepers — including PriceUpKeep, PrivatePriceUpKeep, and TradesUpKeep — as trusted and out of scope. Issues requiring a compromised or malicious keeper, as well as oracle manipulation at the source, were excluded from the program. This exclusion disincentivized security researchers from investigating the exact attack surface that was ultimately exploited. The OstiumPrivatePriceUpKeep contract, the component through which the attack was executed, was either reviewed on an older design iteration or excluded from the most recent audit pass entirely.","heading":"Audit Coverage Gaps and Bug Bounty Exclusions","severity":"high","sources":[{"credibility":1,"name":"Ostium Bug Bounties — Immunefi (scope page)","type":"official","url":"https://immunefi.com/bug-bounty/ostium/scope/"},{"credibility":2,"name":"Ostium Hack: Perp DEX Loses $23.75M in Oracle Key Exploit, Resumes Trading July 23","type":"news_article","url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"credibility":2,"name":"Compromised Oracle Key Drains $18M From Ostium, Exposing DeFi's Off-Chain Blind Spot","type":"news_article","url":"https://www.techtimes.com/articles/320708/20260716/compromised-oracle-key-drains-18m-ostium-exposing-defis-off-chain-blind-spot.htm"}]},{"content":"The Ostium exploit illustrates a structural risk common to DeFi protocols that rely on off-chain price-feed infrastructure: a single compromised signing key can bypass all on-chain security controls. Because Ostium's OstiumPrivatePriceUpKeep forwarder accepted signed price reports without time-bound validation sufficient to detect future-dated timestamps, the attacker's fabricated reports appeared valid to the on-chain settlement logic. The protocol's design effectively made the oracle signer key a single point of failure capable of draining the entire LP vault. Blockchain security analysts noted that standard smart contract audits do not evaluate key custody or off-chain operational security, and Ostium's bug bounty program explicitly excluded this risk category. Security firm Blockaid was the first entity to flag the exploit, through on-chain monitoring rather than a formal disclosure. The exploit also occurred during an active wave of keeper and oracle attacks across DeFi, including a comparable $6 million exploit against Summer.fi the preceding week.","heading":"Structural Risk: Off-Chain Oracle Key Centralization","severity":"high","sources":[{"credibility":2,"name":"Ostium $23.75M Exploit: Not a Smart Contract Bug, an Oracle Key Compromise - and the Structural Risk It Reveals","type":"news_article","url":"https://www.ainvest.com/news/ostium-23-75m-exploit-smart-contract-bug-oracle-key-compromise-structural-risk-reveals-2607/"},{"credibility":1,"name":"Ostium loses $18 million in oracle attack that gamed its own price-feed infrastructure","type":"news_article","url":"https://www.coindesk.com/business/2026/07/15/ostium-suffers-usd18-million-exploit-as-oracle-attack-wave-continues-to-hit-defi"},{"credibility":2,"name":"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack","type":"news_article","url":"https://decrypt.co/373566/defi-exploit-ostium-oracle-hack"}]},{"content":"Ostium Labs was founded in 2022 by Harvard alumni Kaledora Kiernan-Linn (CEO) and Marco Antonio Ribeiro. Kiernan-Linn studied neuroscience at Harvard and previously trained at the Royal Danish Ballet and worked as a quantitative researcher at Bridgewater Associates. Ribeiro is a former competitor in the International Olympiads for physics, biology, and chemistry. The protocol operates on Arbitrum and offers on-chain perpetual swap contracts tied to real-world assets including commodities, equities, forex, and indices. Prior to the July 2026 exploit, Ostium had processed over $50 billion in cumulative trading volume and held approximately $63 million in total value locked. The protocol raised $27.8 million in total funding, including a $20 million Series A co-led by General Catalyst and Jump Crypto announced in December 2025, and a previously undisclosed $4 million strategic round. Additional Series A participants included Coinbase Ventures, Wintermute Ventures, GSR, and Crucible Capital.","heading":"Protocol Background and Investor Backing","severity":"low","sources":[{"credibility":1,"name":"Ostium Raises $20 Million Series A from General Catalyst and Jump Crypto — BusinessWire","type":"official","url":"https://www.businesswire.com/news/home/20251203478893/en/Ostium-Raises-$20-Million-Series-A-from-General-Catalyst-Jump-Crypto-to-Bring-Global-Markets-Onchain"},{"credibility":1,"name":"Jump Crypto, General Catalyst Lead $20M Series A for Onchain Tradfi Perps Firm Ostium — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2025/12/03/ostium-raises-usd20m-series-a-led-by-general-catalyst-jump-crypto-to-put-tradfi-perps-onchain"},{"credibility":1,"name":"Harvard alumni-founded Ostium lands $24 million in fresh funding — The Block","type":"news_article","url":"https://www.theblock.co/post/381241/harvard-alumni-founded-ostium-lands-24-million-in-fresh-funding-to-scale-onchain-perpetuals-for-rwas"},{"credibility":1,"name":"Harvard grads raise $20 million for Ostium — Fortune","type":"news_article","url":"https://fortune.com/2025/12/03/ostium-series-a-fundraise-perpetuals-perps-crypto/"}]},{"content":"Ostium paused all trading within approximately one hour of the first malicious transaction on July 15, 2026. The team published an initial acknowledgment via X: 'We are aware of the issue with the OLP vault. We have paused all trading. The team is investigating.' Ostium confirmed that trader collateral and open positions were held in separate contracts and were not directly affected by the vault drain. The protocol engaged incident response firms and law enforcement, and committed to providing at least 24 hours' notice before resuming operations. Trading reopened in phases on July 23, 2026, beginning with defensive-only actions (position closures, collateral additions, stop-loss execution) before permitting new position openings. Open positions were repriced at live market values at reopening, and liquidations were limited to positions falling below thresholds under the new prices. OLP deposits remained suspended as of reopening, though withdrawals continued through settlement cycles. A formal post-mortem was promised but had not been published as of late July 2026. The protocol's detailed compensation plan for affected liquidity providers remained pending.","heading":"Protocol Response and Trading Resumption","severity":"medium","sources":[{"credibility":2,"name":"Ostium to Resume Trading on July 23 After $18M Arbitrum Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/07/22/ostium-to-resume-trading-on-july-23-after-18m-arbitrum-exploit/"},{"credibility":2,"name":"Ostium on X — official incident statement","type":"official","url":"https://x.com/Ostium/status/2078640436688941194"},{"credibility":1,"name":"Ostium trading platform loses $23.75 million in off-chain exploit — SC World","type":"news_article","url":"https://www.scworld.com/brief/ostium-trading-platform-loses-23-75-million-in-off-chain-exploit"},{"credibility":2,"name":"Ostium Reopens After a Faked Price Drained $23.75M From Its Vault","type":"news_article","url":"https://coinpaprika.com/news/ostium-reopens-faked-price-drained-2375m/"}]},{"content":"The Ostium exploit occurred during what security analysts described as an escalating wave of keeper and oracle attacks against DeFi protocols in 2026. Over $840 million was reported stolen across DeFi in the first five months of 2026 alone. Comparable incidents around the same period included a $6 million exploit against Summer.fi through similar infrastructure vulnerabilities and a broader pattern of keeper-role compromises. The Ostium incident was detected by blockchain security firm Blockaid through on-chain monitoring and was reported by CoinDesk on July 15, 2026. Security commentators noted that the increasing sophistication of AI-assisted vulnerability discovery is accelerating the pace at which off-chain infrastructure weaknesses are identified and exploited. The Ostium case became a reference point in the industry for the risk posed by custodial off-chain signing keys in otherwise non-custodial protocols.","heading":"Broader DeFi Oracle Security Context","severity":"medium","sources":[{"credibility":2,"name":"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373566/defi-exploit-ostium-oracle-hack"},{"credibility":1,"name":"Bitcoin, Ethereum-Linked Protocols Lose $35 Million in Multiple Attacks Hours Apart — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"},{"credibility":2,"name":"Ostium Hit by $18M Exploit After Hacker Manipulates Future-Dated Oracle Data","type":"news_article","url":"https://crypto-economy.com/ostium-hit-by-18m-exploit-after-hacker-manipulates-future-dated-oracle-data/"}]}],"sources_used":[{"credibility":2,"name":"The Ostium Exploit: How a Fake $5,000 Bitcoin Price Drained a Perp DEX — DeFi Prime","type":"news_article","url":"https://defiprime.com/ostium-exploit"},{"credibility":2,"name":"Ostium Hack: Perp DEX Loses $23.75M in Oracle Key Exploit, Resumes Trading July 23 — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"credibility":1,"name":"Ostium loses $18 million in oracle attack that gamed its own price-feed infrastructure — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/15/ostium-suffers-usd18-million-exploit-as-oracle-attack-wave-continues-to-hit-defi"},{"credibility":1,"name":"Bitcoin, Ethereum-Linked Protocols Lose $35 Million in Multiple Attacks Hours Apart — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"},{"credibility":1,"name":"Ostium trading platform loses $23.75 million in off-chain exploit — SC World","type":"news_article","url":"https://www.scworld.com/brief/ostium-trading-platform-loses-23-75-million-in-off-chain-exploit"},{"credibility":2,"name":"Explained: The Ostium Hack (July 2026) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-ostium-hack-july-2026"},{"credibility":2,"name":"Blockaid uncovers $18M exploit that forces Ostium trading halt — crypto.news","type":"news_article","url":"https://crypto.news/blockaid-uncovers-18m-exploit-that-forces-ostium-halt/"},{"credibility":2,"name":"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373566/defi-exploit-ostium-oracle-hack"},{"credibility":2,"name":"Ostium DeFi Platform Breach: $23.75 Million Stolen in Off-Chain Oracle Attack — Rescana","type":"news_article","url":"https://www.rescana.com/post/ostium-defi-platform-breach-23-75-million-stolen-in-off-chain-oracle-attack-and-credential-compromise"},{"credibility":2,"name":"Arbitrum bridge not hacked as $24M exploit drains Ostium DEX through oracle manipulation — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/arbitrum-bridge-not-hacked-ostium-exploit/"},{"credibility":2,"name":"Ostium Halts Trading After Oracle Exploit Drains up to $18M from Vault — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/ostium-halts-trading-after-oracle-exploit-drains-up-to-usd18m-from-vault"},{"credibility":2,"name":"Ostium suspends trading after OLP vault exploit drains up to $23.7M in USDC — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/ostium-suspends-trading-olp-vault-exploit/"},{"credibility":2,"name":"Ostium to Resume Trading on July 23 After $18M Arbitrum Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/22/ostium-to-resume-trading-on-july-23-after-18m-arbitrum-exploit/"},{"credibility":2,"name":"Ostium Reopens After a Faked Price Drained $23.75M From Its Vault — CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/ostium-reopens-faked-price-drained-2375m/"},{"credibility":1,"name":"Ostium Bug Bounties — Immunefi scope page","type":"official","url":"https://immunefi.com/bug-bounty/ostium/scope/"},{"credibility":1,"name":"Ostium Raises $20 Million Series A from General Catalyst and Jump Crypto — BusinessWire","type":"official","url":"https://www.businesswire.com/news/home/20251203478893/en/Ostium-Raises-$20-Million-Series-A-from-General-Catalyst-Jump-Crypto-to-Bring-Global-Markets-Onchain"},{"credibility":1,"name":"Jump Crypto, General Catalyst Lead $20M Series A for Onchain Tradfi Perps Firm Ostium — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2025/12/03/ostium-raises-usd20m-series-a-led-by-general-catalyst-jump-crypto-to-put-tradfi-perps-onchain"},{"credibility":1,"name":"Harvard alumni-founded Ostium lands $24 million in fresh funding — The Block","type":"news_article","url":"https://www.theblock.co/post/381241/harvard-alumni-founded-ostium-lands-24-million-in-fresh-funding-to-scale-onchain-perpetuals-for-rwas"},{"credibility":1,"name":"Harvard grads raise $20 million for Ostium — Fortune","type":"news_article","url":"https://fortune.com/2025/12/03/ostium-series-a-fundraise-perpetuals-perps-crypto/"},{"credibility":2,"name":"Ostium on X — official incident statement","type":"official","url":"https://x.com/Ostium/status/2078640436688941194"},{"credibility":2,"name":"Ostium Hit by $18M Exploit After Hacker Manipulates Future-Dated Oracle Data — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/ostium-hit-by-18m-exploit-after-hacker-manipulates-future-dated-oracle-data/"}],"summary":"Ostium Protocol is an Arbitrum-based decentralized perpetuals exchange specializing in real-world asset (RWA) trading, founded in 2022 by Harvard alumni Kaledora Kiernan-Linn and Marco Antonio Ribeiro and backed by $27.8 million from General Catalyst, Jump Crypto, and Coinbase Ventures. On July 15, 2026, an attacker compromised an off-chain oracle signer private key and injected fabricated BTC/USD prices into the protocol's PriceUpKeep forwarder contract, draining $23,752,746 USDC from the liquidity provider vault through approximately 20 looped trades. Stolen funds were converted to roughly 12,084 ETH and routed through Tornado Cash within hours, and as of late July 2026 no funds have been recovered.","timeline":[{"date":"2022-01-01","event":"Ostium Labs founded by Harvard alumni Kaledora Kiernan-Linn and Marco Antonio Ribeiro","source":"Fortune / The Block","source_url":"https://fortune.com/2025/12/03/ostium-series-a-fundraise-perpetuals-perps-crypto/"},{"date":"2024-01-01","event":"Zellic completes smart contract audit returning 19 findings (2 critical); key custody and off-chain infrastructure explicitly excluded from scope","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"date":"2025-09-01","event":"Pashov Audit Group completes security review covering trading-engine contracts only; PriceUpKeep components not included","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"date":"2025-12-03","event":"Ostium announces $20 million Series A co-led by General Catalyst and Jump Crypto, with Coinbase Ventures and Wintermute participating; total funding reaches $27.8 million","source":"BusinessWire / CoinDesk","source_url":"https://www.coindesk.com/business/2025/12/03/ostium-raises-usd20m-series-a-led-by-general-catalyst-jump-crypto-to-put-tradfi-perps-onchain"},{"date":"2026-07-15","event":"Attacker compromises off-chain oracle signer private key and executes primary exploit transaction (0x359f8c05...d4870e0) at 14:18 UTC, batching ~20 looped trades using fabricated BTC/USD prices ($5,000 open / ~$60,000 close) to drain $23,752,746 USDC from the OLP vault","source":"DeFi Prime / CoinDesk / Blockaid","source_url":"https://defiprime.com/ostium-exploit"},{"date":"2026-07-15","event":"Blockchain security firm Blockaid flags the exploit on-chain; Ostium pauses all trading within one hour of the first malicious transaction and posts acknowledgment to X","source":"crypto.news / Decrypt","source_url":"https://crypto.news/blockaid-uncovers-18m-exploit-that-forces-ostium-halt/"},{"date":"2026-07-15","event":"Stolen USDC converted to approximately 12,084 ETH and routed through Tornado Cash within hours of the attack","source":"CryptoTicker / Rescana","source_url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"date":"2026-07-15","event":"CoinDesk publishes initial coverage reporting approximately $18 million drained; early estimates range $11.86M–$22M before official confirmation","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/07/15/ostium-suffers-usd18-million-exploit-as-oracle-attack-wave-continues-to-hit-defi"},{"date":"2026-07-17","event":"Galaxy Research publishes technical analysis tracing eight payout transactions totaling $23,752,746 USDC to the attacker's single recipient wallet","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/ostium-hack-oracle-exploit-arbitrum/"},{"date":"2026-07-22","event":"Ostium announces trading will resume on July 23 at 10:00 a.m. ET in phases; existing open positions to be repriced at live market values","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/22/ostium-to-resume-trading-on-july-23-after-18m-arbitrum-exploit/"},{"date":"2026-07-23","event":"Ostium reopens trading in phased approach; OLP deposits remain suspended; compensation plan for affected liquidity providers pending; stolen funds remain unrecovered","source":"CoinPaprika / CryptoTimes","source_url":"https://coinpaprika.com/news/ostium-reopens-faked-price-drained-2375m/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 14911300-1a85-40ce-bc46-bca3627b4effcopy