Overview
- Security firm Blockaid detected the theft on Wednesday, July 15, 2026, reporting that an attacker drained about $18 million in USDC from Ostium’s OLP liquidity vault.
- Blockaid’s on‑chain analysis says the exploit relied on authorized future‑dated price reports submitted through the PriceUpKeep forwarder and in some reports on a compromised oracle signer key to manufacture fake profits.
- Ostium halted all trading immediately and froze trader funds and open positions while it investigates the breach with outside security experts.
- On‑chain traces show the attacker converted portions of the stolen USDC into ETH through Kyber and dispersed funds across multiple wallets, which aids forensic tracking but has not produced recoveries.
- The loss is about 28% of Ostium’s roughly $63 million TVL and adds to a 2026 wave of oracle and keeper attacks, highlighting risks in key management and automated price‑feed controls that could hit liquidity providers and force tighter infrastructure safeguards.