Perpetuals protocol Ostium suffered a hack resulting in a loss of about $23.7 million. The hack is believed to have stemmed from a compromised oracle-signer key, which the attacker used to drain the protocol's OLP vault. Whether the key was obtained externally or misused by someone with existing access has not been confirmed.

Using the compromised access, the attacker opened BTC/USD positions with USDC margin, filled the opening order at a fabricated low price, then closed the same position at a fabricated high price, extracting the difference in USDC from the vault, which acts as counterparty to all trader positions. The attacker then swapped the stolen USDC for 12,084 ETH at an average price of $1,966 and has been routing large portions through Tornado Cash.

The OLP vault held about $9 million as of the latest community reporting, down 72.5% from $32.7 million before the attack. Ostium says user positions remain open and unmodifiable, and trader margin remains untouched in the frozen contracts. The team is coordinating with law enforcement, SEAL 911, and third-party security researchers to trace the funds and investigate the breach. Trading remains paused, with no timeline yet given for resumption or fund recovery.

Disclaimer: Content is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. No representations or warranties are made as to accuracy, completeness, or timeliness. Use of this content is at your own risk, and you should consult a qualified professional before making decisions. No fiduciary or advisory relationship is created.