De-fi

How prices from the future fooled a crypto oracle into paying out up to $24 million – Crypto News

Published

55 minutes ago

July 17, 2026

Dripp

Ostium, an on-chain perpetuals trading platform, said a five-minute security incident caused losses from its public liquidity vault. Security firms estimated the exploit at up to $24 million.

Co-founder Kaledora Kiernan-Linn confirmed that the issue ran from 14:18 to 14:23 UTC on July 15 and affected the public Ostium Liquidity Provider (OLP) vault. She said the team identified it within minutes and coordinated a trading pause within the hour. The statement did not give a definitive loss total, identify the root cause, or provide a final postmortem.

Security firms said authorized data, rather than a missing signature, sat at the center of the incident. Blockaid and Cyvers said a registered PriceUpKeep forwarder submitted future-dated, authorized oracle reports that created artificial trading profits.

SlowMist said an authorized signer supplied validly signed manipulated data used for repeated profitable trades. Those descriptions remain third-party findings pending Ostium’s postmortem.

Cryptographic authentication can establish that a permitted key signed a report. Price plausibility, timestamp freshness, and settlement safety require separate controls.

The OstiumVerifier code linked from Ostium’s security documentation recovers an ECDSA signer and checks whether the signer is authorized, but that verifier function does not enforce a price-plausibility test or timestamp bound.

The code does not appear to identify which implementation was active during the incident or whether separate contracts applied those checks. Any timestamp, replay, price-deviation, or multi-source safeguards would have to operate elsewhere in the execution path.

How tokenized stocks fail as collateral even when the stock price does not move

Edel’s exploit was small, but it hit the next frontier for tokenized equities: credit markets, where 1:1 backing is not enough if wrappers, vaults and exchange rates can be gamed.

Jul 2, 2026 · Gino Matos

Ostium’s protocol documentation states that the OLP vault holds traders’ collateral and pays out winning trades immediately on-chain. If artificial profits were accepted for settlement, vault liquidity funded the payouts.

Published estimates rose as tracing continued. Blockaid put the payout near $18 million, Cyvers estimated $23.7 million, and PeckShield later described roughly $24 million drained.