Ostium was hacked, and the LP vault lost 23.75 million USDC.
The method was pretty clean: the attacker didn’t directly break the contract. Instead, they infiltrated the off-chain price data infrastructure, submitted fraudulent prices that the system accepted as valid, and then quickly opened and closed positions to extract the profits.
In one sentence: it’s not that the code was written wrong—it’s that the price source was tricked.
This is even more worth watching than a pure smart-contract vulnerability. In many DeFi perpetual protocols, the truly fragile part isn’t on-chain—it’s off-chain in how the protocol is fed prices. No matter how hard the contract is, if the price feed is soft, it can still be drained.
The good news is: the traders’ collateral sits in a separate contract and hasn’t been affected. The bad news is: the LPs’ money is already gone.
The takeaway for everyday people is very practical:
1. High-yield LPs aren’t a free lunch—often, what you’re “earning” is just the risk premium for being attacked
2. Evaluate the protocol: don’t only look at APY—also check the price source, oracle, and off-chain components
3. Proper fund isolation design is crucial—this time, users’ positions weren’t affected because isolation was in place
Trading can be paused, but if the money can’t come back, that’s hard.
When you choose DeFi protocols in the future, will you care more about APY, or more about oracles and fund isolation?
#Ostium #DeFi攻击 #USDC #预言机 #安全