Ostium Confirms July 15 Exploit Came From an Off‑Chain Infrastructure Breach
TL;DR
- Exploit Origin: Ostium confirmed the July 15 incident stemmed from unauthorized off‑chain access that enabled fraudulent BTC‑USD price reports.
- Attack Method: The attacker tested with a 100 USDC position, then executed larger batches that drained 23.75 million USDC from the OLP vault.
- Post‑Incident Actions: Automated monitoring limited further withdrawals, trading resumed July 23, and a recovery plan for liquidity providers is being prepared.
The team behind Ostium has released new details on the July 15 exploit that drained 23.75 million USDC from its public OLP vault, confirming that the incident originated from a breach of off‑chain infrastructure rather than any flaw in the protocol’s smart contracts or multisigs. The update, published Wednesday, outlines how the attacker gained unauthorized access to off‑chain systems and used that foothold to push fraudulent BTC‑USD price reports into the protocol.
- Ostium (@Ostium) July 29, 2026
Off‑Chain Access Enabled Fraudulent Price Reports
According to the post‑mortem, the attacker leveraged unauthorized access to Ostium’s off‑chain infrastructure to submit manipulated price data. This allowed them to generate artificial trading profits from the OLP vault. The team emphasized that the breach occurred entirely off‑chain and that its investigation found no evidence of issues in the protocol’s smart‑contract logic or governance multisigs.
… Continue reading the full article at the original source below.
