POPA ReconOstium Exploited for $18M - Oracle Key Compromise Drains the LP Vault
Ostium Exploited for $18M - Oracle Key Compromise Drains the LP Vault Ostium, the RWA perp DEX on Arbitrum, lost roughly $18M USDC today - about 28% of its $63M TVL. The attacker compromised an oracle signing key, then used a registered PriceUpKeep forwarder to submit future-dated but validly signed price reports. With tomorrow's prices in hand, they looped ~20 open-close cycles through delegated actions, printing artificial profit on every turn until the vault paid out Ostium's own bug bounty explicitly listed compromised keepers and forwarders as out of scope - "assumed to be trusted and…
The excerpt is quoted from a public Telegram channel, which owns its text.