🚨 BREAKING: Ostium, a RWA perpetuals exchange on Arbitrum, just lost between $18M and $23.7M after an attacker compromised.

Here's what happened: Ostium's oracle system checks whether a price report came from an authorized signer. It doesn't check whether the price itself is real. The attacker held both an authorized oracle signer key and a registered keeper role called PriceUpKeep, the component responsible for actually executing trades. Neither of those should ever be self-assignable, both are meant to be controlled only by Ostium's own governance.
With both pieces in hand, the attacker ran the same loop repeatedly inside single batched transactions: open a position using a fabricated low opening price, close it using a fabricated high closing price, collect the fake profit straight out of the vault. One batch alone cycled this five times for a combined $11.86 million. They did it multiple more times after that.
This wasn't a flash loan or a thin-liquidity price manipulation, the kind of exploit DeFi has spent years hardening against. This was a stolen or misused signing key, a problem no amount of on-chain liquidity depth can protect against.
The vault held $32.7 million before the attack. It holds about $9 million now, a 72% drop. The attacker's already converted most of the stolen $USDC into $ETH and started laundering it through Tornado Cash. Ostium paused trading within the hour and says trader funds and open positions remain frozen and intact.
This is the second oracle signer compromise in DeFi within two weeks. Bonzo Finance lost $9 million to nearly the same mechanism just four days earlier. Auditors keep checking the code. Almost nobody's auditing who holds the keys.