Ostium blames off chain breach for $23.75M USDC exploit

Ostium has concluded that its July exploit originated from compromised off-chain infrastructure rather than a flaw in its smart contracts, after an investigation found the attacker manipulated price reporting to drain 23.75 million USDC from the protocol’s liquidity vault. Summary Ostium said its investigation found the July exploit originated from compromised off chain infrastructure rather than a flaw in its smart contracts. Fraudulent BTC USD price reports allowed the attacker to drain 23.75 million USDC from the protocol’s OLP liquidity vault. The protocol said automated monitoring detected the attack, trading resumed on July 23, and user collateral remained unaffected. A recovery plan for affected liquidity providers is being finalized and will be shared in a separate update. According to Ostium’s post-mortem published on Wednesday, the attacker gained unauthorized access to the protocol’s off-chain infrastructure and used it to submit fraudulent BTC-USD price reports. The manipulated reports allowed the attacker to create artificial trading profits at the expense of the public OLP vault, while the protocol found no evidence that its smart contracts or governance multisigs had...