Ostium blames off-chain breach for $24 million exploit, rules out smart contract flaw

Onchain perpetuals exchange Ostium said its July 15 exploit, which drained 23.75 million USDC from its OLP vault, stemmed from a compromise of its off-chain infrastructure rather than vulnerability in its smart contracts or protocol multisigs.

In a post-mortem published Wednesday, Ostium wrote that the attacker leveraged unauthorized access to the protocol's off-chain infrastructure to submit fraudulent BTC-USD price reports. This enabled the attacker to generate artificial trading profits from the public OLP vault.

Ostium said that this initial unauthorized access occurred off-chain.

"Based on our investigation, we have no evidence this incident was a result of a vulnerability in Ostium's smart-contract code logic or a compromise of the multisigs that govern the protocol," the team said.

Specifically, the attacker used forwarder paths that were already recognized by the protocol. They first tested with a 100 USDC position to generate roughly 897.8 USDC of artificial profit.

The attacker then executed the main batch, resulting in 11.9 million USDC transferred to the beneficiary wallet, and later executed six further standalone cycles. In total, the attack drained 23.75 million USDC from the OLP vault.

The Ostium team noted that its automated monitoring detected the activity and ultimately prevented further withdrawals. The protocol has since migrated to a new production environment with updated security controls, and trading resumed on July 23.

Ostium also said that trader collateral was not affected and user margin remained in the protocol's trading contracts. 

"A separate recovery plan for liquidity providers is being finalized and will be shared in a separate post," the team added.

The exploit came after Ostium partnered with Nasdaq in May to power equity perpetual products using the exchange operator's market data. At the time, the protocol said it had processed more than $50 billion in cumulative trading volume.