Ostium trading platform loses $23.75 million in off-chain exploit

The Ostium trading platform announced that an attacker stole $23.75 million from its liquidity provider vault last week after compromising off-chain infrastructure used to feed prices into the protocol, according to a recent report by Bleeping Computer.

The attacker manipulated illegitimate price reports to disguise them as valid ones, then rapidly opened and closed large positions to generate artificial profits. Trader collateral and existing positions were not directly affected, as they are held in separate contracts. Ostium, a decentralized trading platform on Arbitrum, uses external data feeds for prices, which were compromised in this incident. The stolen USDC was swapped for Ethereum and sent to TornadoCash, a cryptocurrency mixer.

Trading on the platform remains paused, with Ostium promising at least 24 hours' notice before operations resume and a post-mortem analysis to follow. The incident highlights the vulnerability of off-chain infrastructure in decentralized finance protocols.

Source: Bleeping Computer