Ostium Trading Platform Hacked for $23.7 Million in Off-Chain Price Manipulation Attack
The **Ostium** decentralized trading platform has fallen victim to an sophisticated attack, resulting in the theft of $23.75 million from its liquidity provider vault. Attackers exploited vulnerabilities in off-chain infrastructure responsible for feeding price data to the protocol, manipulating these feeds to generate illicit profits.
**Ostium**, a decentralized trading platform built on the **Arbitrum** blockchain scaling solution, announced a significant security incident last week. The platform, which allows users to speculate on traditional and crypto assets directly from a cryptocurrency wallet, suffered a loss of $23.75 million from its liquidity provider vault.
### The Attack Vector: Manipulating Off-Chain Price Feeds
The attackers did not directly compromise **Ostium**'s core smart contracts holding trader collateral. Instead, they targeted the off-chain infrastructure responsible for providing real-time price data to the protocol. By submitting illegitimate price reports disguised as valid ones, the attackers were able to rapidly open and close large positions, generating artificial profits at the expense of the liquidity provider's vault.
**Ostium** clarified that trader collateral, held in a separate smart contract, was not affected. Existing trading positions also remain open, although all trading on the platform was paused within 60 minutes of the initial exploit transaction.
### Tracing the Stolen Funds
Following the theft, blockchain security firm **PeckShieldAlert** traced the movement of the stolen funds. The exploiter swapped the **USDC** (a cryptocurrency pegged 1:1 to the US dollar) for 12,080 **Ethereum** (ETH). A significant portion, 10,540 **Ethereum**, was then deposited into **Tornado Cash**, a cryptocurrency mixer often used to obscure transaction origins.
*Source: PeckShieldAlert*
### Ostium's Response and Path Forward
**Ostium** informed its community about the incident on July 16, confirming that relevant authorities had been notified and that efforts to track the stolen funds were underway. The company is currently working to secure the compromised infrastructure and determine a strategy for liquidity providers.
Trading on **Ostium** remains paused, with the company promising to provide at least 24 hours' notice before operations resume. Upon reopening, positions will be marked to the new reopening price. **Ostium** has also committed to releasing a detailed post-mortem analysis with technical specifics in the coming days.
*Source: BleepingComputer.com*