Ostium: trusted oracle-signer and keeper roles used to post fake prices

What happened

• 15 Jul 2026, Arbitrum: about USD 23.75M drained from the OLP vault in eight payouts (BlockSec). Early estimates were USD 18M (Blockaid) and USD 22M (CertiK).
• Root cause: compromise of off-chain price infrastructure. The attacker used trusted oracle-signing authority and a registered PriceUpKeep forwarder to submit validly signed prices with attacker-chosen timestamps (input near 5,000, settlement near 60,000), scaling positions inside one executeBatch() call. How those credentials were obtained is not disclosed; Blockaid did not say a private key was stolen.
• Attribution: none.
• Response: trading contracts frozen and a post-mortem published. The Defiant notes the bug bounty treated registered keepers as trusted, so this class was out of scope.

Sources

• https://blocksec.com/blog/defi-security-incidents-afx-trade-ostium
• https://galaxy.com/insights/research/ostium-left-an-opening-for-exploiters-and-24m-went-out-the-door
• https://thedefiant.io/news/hacks/ostium-halts-trading-after-oracle-exploit-drains-up-to-usd18m-from-vault

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.