cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Ostium Says Attacker Stole $23.75 Million by Manipulating Off-Chain Price Feeds

· Original article ↗

Summary

Ostium says an attacker manipulated off-chain price reports to steal $23.75 million from its liquidity provider vault. Trader collateral was unaffected, but trading remains paused as the platform secures infrastructure and prepares a post-mortem.

Key points

  • Ostium said an attacker stole $23.75 million from its liquidity provider vault after compromising off-chain price-feed infrastructure.
  • The attacker reportedly submitted fake price reports and rapidly opened and closed positions to generate artificial profits.
  • Ostium said trader collateral was held separately and was not stolen; existing positions remain recorded but are effectively frozen while trading is paused.
  • PeckShieldAlert reported that the stolen USDC was swapped for 12,080 ETH, with 10,540 ETH deposited to Tornado Cash.
  • Ostium paused trading within 60 minutes of the first exploit transaction and said trading remained paused five days later.
  • Ostium said it is securing the affected infrastructure and plans to publish a technical post-mortem.

Article Details

Victim Organization
Ostium
Incident Type
Theft of funds from a liquidity provider vault through manipulation of off-chain price feed infrastructure and submission of illegitimate price reports.
Operational Impact
Trading was paused within 60 minutes of the first exploit transaction and remained paused five days after the incident. Existing positions were effectively frozen; Ostium said trader collateral and positions were not stolen or liquidated.
Claim Status
confirmed

Products

Arbitrum#OstiumEthereumThe platform paused trading, confirmed trader collateral was not stolen, and said the stolen USDC was later swapped into Ethereum and partially sent to Tornado Cash.OstiumOstium said an attacker stole $23.75 million from its liquidity provider vault after compromising off-chain price feed infrastructure and submitting fake price reports to generate artificial profits.Tornado CashThe platform paused trading, confirmed trader collateral was not stolen, and said the stolen USDC was later swapped into Ethereum and partially sent to Tornado Cash.USDCThe platform paused trading, confirmed trader collateral was not stolen, and said the stolen USDC was later swapped into Ethereum and partially sent to Tornado Cash.

Related Articles