Ostium Oracle Exploit: How a Stolen Signer Key Drained $18M from Arbitrum's RWA Perp DEX

How the $18M Exploit Worked

Blockchain security firm Blockaid was the first to flag the exploit on-chain, noting that the attacker began swapping the stolen USDC into ETH via Kyber shortly after the attack . The attack unfolded in three steps:

1. Key compromise: The attacker obtained the private key of a registered oracle signer — a credential authorized to submit price data to the protocol .
2. Price manipulation: Using the compromised key, the attacker submitted future-dated, favorable price reports through a registered PriceUpkeep forwarder contract on the Gelato network .
3. Profit extraction: The attacker executed roughly 20 looped delegated trades, opening and closing positions at the fabricated prices to generate fictitious trading profits . The protocol's vault then paid out those phantom profits in real USDC .

Loss estimates across sources range from $12 million to $22 million, with most reports pegging the figure at ~$18 million . Blockaid estimated roughly $18 million in losses, while CertiK placed the figure at about $22 million; both firms attributed the incident to a compromise of Ostium's oracle system .

What Percentage of TVL Was Lost?

The percentage depends on the baseline used, and sources give different figures:

• ~35% of the protocol's ~$34 million treasury/vault
• 35% of the OLP liquidity vault ($34M)
• 28% of total TVL ($63M)
• Generally described as "about one-third of its liquidity"

The most commonly cited figure is roughly 35% of the protocol's $34+ million treasury/vault .

Ostium's Backers and Funding

Ostium raised approximately $27.8 million from backers including General Catalyst and Jump Crypto . Other earlier funding rounds were also reported, but General Catalyst and Jump Crypto are the two named institutional investors in connection with this exploit .

How This Fits the 2026 DeFi Key-Theft Trend

The Ostium exploit is not a novel smart-contract vulnerability — it is a private-key credential theft used to manipulate a trusted price-feed mechanism. That places it squarely within the dominant 2026 attack pattern:

• 72% of all DeFi losses in 2026 came from stolen keys and credential theft, not from smart contract bugs .
• Infrastructure and operational compromises (key theft, access control breaches) accounted for only about 15% of incidents but roughly 76% of total dollar losses — far exceeding the impact of traditional code exploits .
• H1 2026 recorded 207 hack incidents — the highest six-month count ever — with total losses of ~$972 million .
• April was the worst month, driven largely by two North Korea-linked key compromises: KelpDAO ($293M) and Drift Protocol ($280M) . Those two thefts alone accounted for over three-quarters of Q2 losses .

According to DeFiLlama data, blockchain projects have collectively lost approximately $16.69 billion through hacks and exploits over time, with around 40% of those losses resulting from private key compromises . On a cumulative basis, more than $17 billion has been stolen via 518 recorded private key incidents over ten years .

The bottom line: the Ostium exploit was a textbook case of attackers shifting from exploiting code to stealing keys, where a small number of key-compromise events cause a disproportionately large share of total losses . For DeFi protocols, auditing smart contracts is no longer enough — securing oracle signer keys and other privileged credentials has become the new front line.