The exploiter behind the Ostium vault hack has begun moving stolen funds through Tornado Cash, with blockchain security firm PeckShield confirming that 10,540 ETH, worth approximately $24 million, has been routed through the privacy mixer. The amount exceeds the initial estimates that placed the loss at up to $18 million.
The exploit targeted Ostium, an Arbitrum-based perpetuals trading protocol, on July 15. The attacker used a registered price-feed forwarder to submit future-dated oracle reports, allowing them to book fraudulent trading profits that drained funds from the project OLP vault.
Blockchain security firms Blockaid and PeckShield tracked the attacker movements as funds were shifted through multiple addresses before being deposited into Tornado Cash. The use of the mixer makes it more difficult for investigators to trace the funds and increases the likelihood that the stolen assets will be successfully laundered.
Ostium has halted trading on its platform pending a security review and is working with security firms to investigate the exploit. The protocol has not announced a timeline for reopening or detailed any plans for compensating affected users.
The attack is the latest in a series of oracle manipulation exploits that have drained millions from DeFi protocols. These attacks exploit the reliance of DeFi platforms on external price feeds, tricking the protocol into accepting manipulated price data that enables fraudulent transactions.
The Ostium exploit highlights the ongoing security challenges facing the DeFi sector, where the complexity of smart contract interactions creates numerous attack surfaces that sophisticated hackers can exploit.
This article was adapted from The Defiant. Read the original here.
