An attacker drained roughly $11.86 million in USDC from Ostium, a perpetuals exchange on Arbitrum, on July 15, using a single transaction that exploited the platform's custom price oracle. The exploit delivered a fabricated BTC/USD price — $5,000 to open a position and about $60,000 to close it — through a batch of 20 calls. Ostium has not yet confirmed the full extent of the loss, and the figure is provisional.
How the attack worked
The transaction used executeBatch, alternating between Ostium's Trading contract and the OstiumPrivatePriceUpKeep contract, which delivers signed prices on-chain. The attacker targeted the BTC/USD pair (pairIndex 0) specifically. The wallet had opened its first position minutes earlier with a rounding-error deposit, a sign the attack was premeditated.
What Ostium is
Ostium is a decentralized perpetuals exchange for real-world assets — stocks, commodities, indices, currencies — built on Arbitrum. It uses a pull-based oracle system: Stork Network for real-world asset feeds and Chainlink Data Streams for crypto feeds. The project raised $3.5 million in a 2023 seed round led by General Catalyst and LocalGlobe, and a $20 million Series A in December 2025 co-led by General Catalyst and Jump Crypto, totaling about $27.8 million. As of December 2025, Ostium advertised over $25 billion in cumulative trading volume, including roughly $5 billion in metals. DefiLlama showed its TVL near $63 million on the day of the exploit.
A familiar pattern
The exploit bears a resemblance to the Resolv USR stablecoin exploit in March, where a single privileged role could mint without on-chain limits. In both cases, a trusted component — here the price oracle, there a minting role — was abused. The exact authorization failure at Ostium hasn't been confirmed, and the reconciled total loss is still pending.
Ostium has not yet published a post-mortem or a final loss figure. The provisional number stands until the exchange or an independent analyst releases a reconciled total. Users are left waiting for clarity on whether funds will be restored and what changes will be made to the oracle system.
