Ostium is the main venue for on-chain real-world-asset perps — gold, oil, FX pairs and equity indices — at leverage far above crypto-native venues. In July 2026 an attacker compromised an oracle signer key and drained $23.75M; trading reopened on 23 July.
A two-tier liquidity design pairs a market-making vault with a buffer that absorbs trader PnL. Prices come from low-latency RWA oracles, and markets respect traditional session hours.
Ostium was exploited for $23.75M in July 2026 when an attacker obtained an oracle signer private key and manufactured profitable trades until the vault was drained. Oracle-priced venues concentrate trust in whoever signs the price feed, and Ostium's RWA markets depend on thinner feeds than crypto. Markets also close at weekends, creating gap risk, and 200x leverage on FX is extremely unforgiving.
Exploits, rebrands and other events that materially changed this venue.
An attacker obtained an oracle signer private key and used it to post fabricated prices, opening trades that settled profitably until the USDC vault was empty. Not a pricing-model failure but a key-management one.
source ↗Ostium resumed trading eight days after the exploit.
Deepest first.
Its public API is unreachable from our servers right now, so we're showing the profile without live figures. The rest of the page is still accurate.
Ostium awards points for trading its RWA markets and for supplying the liquidity vault.
How to earn Trade commodities, FX and index perps, or deposit USDC into the OLP vault.