Abracadabra DeFi Ostium Loses 2.68 Billion Won Due to Oracle Manipulation

Approximately 2.68 billion won was siphoned off from the DeFi project Ostium, based on Arbitrum (ARB). The attacker manipulated oracle price data to steal around 18 million USD (approximately 2.68 billion won) worth of USDC. According to on-chain data analysis, the attack was carried out by manipulating the timestamps of the oracle system. The attacker exploited Ostium's automated infrastructure, the 'PriceUpKeep Forwarder', to submit price data from a future point in time, creating trades that were more favorable than actual market conditions. The manipulated price report was recognized by the system as a 'profitable trade', leading to automatic fund disbursement from the liquidity vault. Ostium is a decentralized perpetual futures exchange based on Arbitrum, allowing for leverage trading of up to 200 times. This project uses its own price feed system, with an external automation network, Gelato, reflecting the prices. However, a structural risk was revealed, as it became possible to manipulate the timing or content of the price data if certain permissions were obtained. This incident resembles the recurring patterns of oracle and keeper system attacks in the recent DeFi industry, with experts pointing out that while oracles are the heart of DeFi, they can also be its most vulnerable point. Ostium had rapidly grown, raising 24 million USD by the end of 2025, but this incident has exposed structural risks.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.