Onchain perpetuals trading platform Ostium has attributed its $23.75 million exploit to a compromise of its off-chain infrastructure, saying its investigation found no evidence that vulnerabilities in its smart contracts or protocol multisigs were responsible for the attack.
The incident occurred on July 15, when an attacker manipulated BTC-USD price reporting to generate artificial trading profits and withdraw millions of USDC from Ostium’s public OLP liquidity vault.
Attacker Manipulated BTC Price Reports
According to Ostium’s post-mortem, the attacker gained unauthorised access to infrastructure operating outside the blockchain and used that access to submit fraudulent BTC-USD price reports.
The manipulated pricing information allowed positions to appear significantly more profitable than they actually were, enabling the attacker to extract funds from the OLP vault.
Ostium stressed that the initial security compromise occurred off-chain, rather than through an exploit of the protocol’s underlying smart contracts.
The team said its investigation found no evidence that either Ostium’s smart contract logic or the multisignature wallets governing the protocol had been compromised.
Attack Began With a Small Test Transaction
The attacker reportedly used forwarder pathways that were already recognised by Ostium’s infrastructure.
Before attempting the larger exploit, the attacker opened a position using just 100 USDC, generating approximately 897.8 USDC in artificial profit.
After confirming that the method worked, the attacker dramatically increased the scale of the operation.
The main batch of transactions resulted in approximately 11.9 million USDC being transferred to the attacker’s beneficiary wallet.
Six additional standalone cycles followed, eventually bringing total losses from the OLP vault to approximately 23.75 million USDC.
Automated Monitoring Prevented Further Losses
Ostium said its automated monitoring systems detected the suspicious activity and ultimately prevented additional withdrawals.
Following the exploit, the protocol migrated operations to a new production environment with updated security controls designed to address weaknesses identified during the investigation.
Trading subsequently resumed on July 23.
The response highlights a growing security challenge for decentralised financial platforms. Even when smart contracts themselves remain secure, protocols can still depend on off-chain systems for price feeds, transaction forwarding and other critical infrastructure.
Compromising those systems can potentially allow attackers to manipulate otherwise functioning onchain applications.
Trader Collateral Was Not Affected
Ostium said the exploit specifically affected assets held within the OLP liquidity vault.
Collateral belonging to traders was not impacted, according to the platform, with user margin remaining inside Ostium’s trading contracts throughout the incident.
The distinction is significant because liquidity providers rather than individual traders appear to have absorbed the direct financial impact of the attack.
Ostium said it is now finalising a recovery plan for affected liquidity providers, with additional details expected in a separate announcement.
Exploit Highlights Risks Beyond Smart Contracts
The incident demonstrates how DeFi security increasingly extends beyond auditing blockchain code.
Modern decentralised trading platforms frequently combine smart contracts with off-chain infrastructure responsible for functions such as market data, price reporting, automation and transaction processing.
That creates a broader attack surface.
A protocol’s contracts can operate exactly as designed while manipulated external information causes them to execute economically damaging transactions.
For perpetual trading platforms in particular, price-data integrity is critical, because even temporary manipulation can create artificial profits or trigger incorrect liquidations.
Incident Comes After Ostium’s Nasdaq Partnership
The exploit follows Ostium’s partnership with Nasdaq, announced in May, to support equity perpetual products using the exchange operator’s market data.
At the time of the partnership, Ostium said the platform had processed more than $50 billion in cumulative trading volume.
The July attack therefore represents an important security test as the protocol attempts to expand the range and scale of markets available through its infrastructure.
Ostium’s findings also reinforce a broader lesson for onchain finance: protocol security cannot end at the smart contract layer.
As DeFi applications increasingly combine decentralised settlement with external data and off-chain infrastructure, protecting those surrounding systems is becoming just as important as securing the blockchain code itself.
