• 2 min read
$23.75M stolen from Ostium in off-chain breach
Ostium says attackers manipulated off-chain price feeds and drained $23.75 million from its liquidity provider vault. Trader collateral was not affected.
Image: BleepingComputer
Ostium says an attacker stole $23.75 million from its liquidity provider vault last week by compromising the off-chain infrastructure that supplies prices to the protocol.
In an update posted yesterday, the decentralized trading platform said the attacker sent illegitimate price reports that appeared valid, then quickly opened and closed large positions to create artificial profits. Ostium said trader collateral was held in a separate contract and was not affected, and that existing positions remain open.
Built on Arbitrum, Ostium lets users trade exposure to traditional and crypto assets directly from a crypto wallet. The protocol relies on external price feeds, while trades are settled in USDC, the dollar-pegged cryptocurrency.
The company first told its community about the incident on July 16, saying trading had been paused because of a security issue. At the time, Ostium said it had notified relevant authorities and was tracking the stolen funds.
According to Ostium’s latest explanation, the breach targeted the off-chain systems that feed prices into the platform, allowing the attacker to manipulate prices and extract funds from the liquidity provider vault. PeckShieldAlert said the exploiter swapped the stolen USDC for 12,080 Ethereum and then deposited 10,540 Ethereum into TornadoCash, a crypto mixer.
Recommended reading
Free 0Patch fix arrives for Windows LegacyHive zero-day
Ostium said leveraged position amounts are stored in a separate smart contract that was not impacted. It also said collateral from ordinary traders was not stolen, and existing long and short positions were neither closed nor liquidated. Those positions are still recorded, but effectively frozen after trading was paused within 60 minutes of the first exploit transaction.
The company said it is securing the affected infrastructure and working out next steps for liquidity providers.
Five days after the incident, trading on Ostium remains paused. The company said it will give at least 24 hours' notice before reopening, and positions will be marked to the reopening price. Ostium also said a technical post-mortem is coming in the next few days.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
