TLDR
- Ostium blamed an off-chain infrastructure breach for the July 15 exploit.
- The attacker drained 23.75 million USDC from the protocol’s OLP vault.
- Fraudulent BTC-USD price reports created artificial trading profits.
- Ostium found no flaw in its smart contracts or protocol multisigs.
- Trader collateral and user margin remained secure in trading contracts.
Ostium said an off-chain security breach caused the July 15 exploit that drained 23.75 million USDC from its OLP vault. The perpetuals exchange ruled out a flaw in its smart contracts or a compromise of its protocol multisigs.
The company published its findings in a post-mortem on Wednesday. It said the attacker gained unauthorized access to off-chain systems and submitted false BTC-USD price reports to the protocol.
Ostium Traces Attack to Off-Chain Systems
According to Ostium, the fake price reports allowed the attacker to record artificial trading profits. The funds came from the public OLP vault, which provides liquidity for trading activity on the platform.
The attacker used forwarder paths already recognized by the protocol. A test position worth 100 USDC generated about 897.8 USDC in false profit before the larger transactions began.
The main batch transferred 11.9 million USDC to a beneficiary wallet. The attacker later completed six more standalone trading cycles using the same method.
The total loss reached 23.75 million USDC. Ostium said its automated monitoring systems detected the activity and stopped further withdrawals before more funds could leave the vault.
Smart Contracts and Trader Funds Remain Safe
Ostium said its investigation found no evidence of errors in its smart contract code. The team also found no evidence that attackers gained control of the multisig wallets used to manage the protocol.
Trader collateral was not affected by the breach. User margin remained inside the protocol’s trading contracts, while the losses were limited to funds held in the OLP liquidity vault.
The platform moved its operations to a new production environment with updated security controls. Ostium resumed trading services on July 23 after completing the migration.
The team is preparing a separate recovery plan for affected liquidity providers. Ostium said it will publish further details once the plan is finalized.
Be the first to comment