Ostium oracle incident drained up to $24M from OLP vault

Ostium's five-minute security incident matters because it shows how an oracle can fail even when signatures look valid. The issue hit the platform's public OLP liquidity vault on July 15 between 14:18 and 14:23 UTC, and outside estimates now put the loss between about $18 million and $24 million.

Ostium co-founder Kaledora Kiernan-Linn said the team spotted the problem within minutes and coordinated a trading pause within the hour. The company has not published a final loss figure or root cause yet. Still, several security firms reached a similar early view: the problem was not a missing signature, but authorized oracle reports with future-dated or manipulated price data that created false trading profits.

Ostium's own documentation says the OLP vault holds trader collateral and pays winning trades on-chain right away. That means any artificial profits accepted by the system would have been paid directly from vault liquidity. SlowMist tracked one USDC outflow of 11,862,444.782, while PeckShield said stolen USDC was swapped into 12,080 ETH. By PeckShield's update, 10,540 ETH had already reached Tornado Cash.

The team said it is working with law enforcement, SEAL 911, and outside security specialists while it investigates whether a signer was compromised or another authorized path was abused.