Ostium $18M Oracle Exploit
A relentless wave of DeFi exploits—spanning smart contracts, bridges, oracles, and MEV bots—is draining hundreds of millions and pushing 2026 toward record hack losses.
The Ostium perpetual DEX suffered an $18 million exploit attributed to an oracle key compromise, forcing the platform to pause all trading. Blockaid identified and disclosed the attack. The incident is the latest in a documented wave of oracle attacks targeting DeFi infrastructure.
Ostium: the oracle was the back door
Ostium didn't get hacked in the usual sense. The attacker didn't crack the trading engine or drain wallets by brute force. They got hold of a key that was authorised to submit price data, then used it to feed the protocol future-dated, falsified prices — prices the system trusted completely and paid out accordingly. Eighteen million dollars in USDC, gone.
A decentralised exchange still has to know what an asset is worth in the real world, and the bridge that carries that information — the oracle — is a single point of trust in a system built to eliminate single points of trust.
Hyperliquid is winning the perp DEX race in part because it has survived its own crises and kept volume growing. Ostium, with $63 million locked and a fresh Nasdaq data partnership, looked like a serious contender. The oracle key was the thing nobody was watching.
6 sources
- OSTIUM 疑似遭遇攻击，损失约1800万美元 · panewslab.com · T2
- Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack · decrypt.co · T1
- A Cryptocurrency Platform Was Hacked: Major Losses Reported – Transactions Suspended · en.bitcoinsistemi.com · T2
- Ostium pauses trading after apparent $18 million vault exploit · theblock.co · T1
- Blockaid uncovers $18M exploit that forces Ostium trading halt · crypto.news · T2
- Ostium suffers $18 million exploit as oracle attack wave continues to hit DeFi · coindesk.com · T1