2026 Ostium — oracle/keeper exploit; ~$18M USDC drained from OLP vault (Jul 15)

Verified protocol incident — July 15, 2026. Ostium, an Arbitrum Layer-2 perpetuals exchange for real-world assets (gold, forex, equity indices) settled in USDC, confirmed an OLP vault issue and paused all trading while investigating. On-chain security firm Blockaid said an attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering roughly $18 million USDC payout from the vault; independent observers cited figures from about $11.9 million to as high as ~$24 million, and some secondary coverage cited ~$18.4 million. Halborn and other explainers described the mechanism as opening synthetic positions against artificially low BTC/USD prints then closing at market, looping the trade for compounded profit; some accounts characterize the root as a compromised off-chain oracle private key, while The Defiant noted Blockaid’s public posts emphasize a registered forwarder and authorized reports rather than proving key theft. Ostium’s Immunefi bug-bounty scope treated registered keepers/forwarders as trusted, putting this class of finding out of scope. Pre-incident TVL was about $63 million per DefiLlama. This is a DeFi liquidity/oracle security incident, not a traditional customer PII breach; recordsAffected remains 0.