Arbitrum-based DEX Ostium targeted in $18 million vault exploit: Report

Arbitrum-based DeFi protocol Ostium has halted trading after a reported exploit in its OLP vault led to an estimated $18 million USDC loss. Security firm Blockaid, the first to report the incident, said the attacker manipulated oracle data to generate fake trading profits.

An attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profit, triggering a ~$18M USDC payout from the vault.More details in 🧵

— Blockaid (@blockaid_) July 15, 2026

Blockaid said the attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to fabricate trading profits, allowing them to extract roughly $18 million USDC from the vault.

Ostium said it was aware of the incident. The project has suspended all trading activity, and is actively investigating the issue.