Ostium Attack Post-mortem: Off-chain Oracle Permissions Stolen, Forged BTC Price to Arbitrage 23.75 Million USDC

TechFlow reports, on July 30, according to Ostium's official report, the core of this attack lies in the compromise of off-chain price reporting system permissions, unrelated to smart contract vulnerabilities.

After obtaining off-chain authorization, the attacker exploited the protocol's registered legitimate forwarding paths to submit forged prices ($5,000 and $60,000) to the BTC-USD market, atomically completing an open-close position arbitrage cycle within the same transaction, starting with 100 USDC to roll and amplify the scale, across 8 transactions, extracting 23.75 million USDC from the OLP Vault within 5 minutes, until the vault circuit breaker mechanism was triggered.

The root cause lies in the off-chain infrastructure lacking a multi-party approval mechanism equivalent to on-chain multisig, creating a single-point permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still underway.