Ostium Halts Trading After Oracle Exploit Reports by Security Firms

Ostium, a decentralized perpetuals trading protocol built on Arbitrum, has paused all trading after security firms reported what they described as an exploit tied to the protocol’s OLP liquidity vault. Blockaid and CertiK both said the incident appeared to stem from a compromise of Ostium’s oracle infrastructure, which feeds external price data into the platform.

Blockaid estimated losses at around $18 million, while CertiK put the figure closer to $22 million. Ostium said it identified an issue affecting the vault and is investigating, but it has not yet confirmed the cause or independently verified the loss estimates.

Key takeaways

• Ostium paused trading after reporting an issue in its OLP liquidity vault.
• Two security firms diverged on losses: Blockaid estimated ~$18M; CertiK estimated ~$22M.
• The suspected root cause is oracle compromise, according to Blockaid and CertiK.
• Ostium urged users to revoke approvals for its contracts while it investigates.

Trading halted and user action requested

On X, Ostium announced it was pausing all trading after identifying a problem affecting the vault. In a subsequent update, the protocol recommended that users temporarily revoke approvals for its contracts “until we can further investigate the recent incident,” framing the guidance around user security.

Ostium’s statements indicate the team has not concluded what happened. The protocol also said it is still investigating the matter and has not confirmed the precise cause behind the exploit or the size of the losses referenced by external security firms.

For traders and liquidity providers, these steps matter because approval management can be directly relevant to how funds could be moved or accessed by smart contracts. Until the protocol provides a more detailed technical assessment, users are essentially operating on partial information—security firm analysis on one side and Ostium’s ongoing review on the other.

Security firms point to oracles, not just smart-contract bugs

Blockaid and CertiK attributed the apparent incident to a compromise of Ostium’s oracle system. Oracles are the mechanism that translates external data—commonly asset prices—into onchain inputs. When an oracle is manipulated or fails, it can distort how a protocol prices assets or calculates settlement conditions, potentially enabling exploits even when core smart contracts are functioning as designed.

Blockaid’s estimate of roughly $18 million in losses and CertiK’s estimate of about $22 million underline that there may be uncertainty in how the damage is measured—particularly in DeFi incidents where attackers can move funds across multiple steps and venues before or after the exploit is detected.

The gap between the estimates also signals why protocols tend to pause operations quickly: with incomplete visibility, the safest near-term action is to stop new trading activity while the affected contracts and oracle pathways are examined.

What Ostium offers—and why the vault issue is central

Ostium is an onchain perpetuals platform for leveraged trading, offering exposure to 75 trading pairs across categories that include stocks, ETFs, commodities, indices, foreign exchange, and cryptocurrencies. Its deployment on Arbitrum places it within the broader wave of offchain-scale improvements offered by Ethereum-compatible networks, but security remains a cross-chain concern: the protocol’s onchain design still depends on offchain components such as oracle data.

The reported issue is specifically linked to Ostium’s OLP liquidity vault. Liquidity vaults are typically used to manage pooled assets that can back trading positions and related settlement flows. If an oracle compromise leads to incorrect accounting—such as mispricing, liquidation logic manipulation, or unfair transfers—vaults can become the conduit through which value is extracted.

DeFi hacks keep targeting infrastructure

The Ostium halt is another reminder that DeFi incidents continue to be persistent even as the industry invests in security tooling and formal best practices. DeFiLlama data cited by Cointelegraph indicated that crypto hacks caused nearly $630 million in losses during April, the highest monthly total since February 2025. DeFi protocols accounted for the majority of that figure, with exploits at KelpDAO and Drift Protocol contributing more than 80% of the April total.

In recent research and commentary, security observers have argued that the threat focus is shifting. Instead of only exploiting weaknesses in smart contracts directly, attackers increasingly go after offchain infrastructure—particularly oracle systems, privileged access controls, and key management processes. That pattern aligns with the Ostium incident as described by Blockaid and CertiK.

Concerns extend beyond immediate technical risk. The repeated occurrence of these incidents has fed questions about whether DeFi is ready to support institutional participation at scale. Earlier coverage highlighted that bridges and other connecting components remain a major security challenge for the sector, and that scaling DeFi for broader adoption requires more than yields—it requires credible operational resilience.

There are also economic constraints. As Cointelegraph previously reported, shrinking DeFi yields can make security costs harder to justify, and institutions may struggle to quantify hack risk versus expected returns. In a May conversation cited by Cointelegraph, the CEO of smart contract security firm Statemind and Symbiotic co-founder Misha Putiatin said institutions increasingly find it difficult to price hack risk, which can reduce appetite for sector exposure despite rising interest in blockchain-based finance.

What to watch next

Investors and users should monitor whether Ostium releases a fuller incident report that clarifies how the oracle system was compromised, which contracts or components were affected, and whether user funds remain recoverable. Equally important will be whether the protocol updates its oracle design or control mechanisms to prevent recurrence—and how quickly trading and liquidity operations can safely resume.