Decentralized trading protocol Ostium paused trading Wednesday after blockchain security firms Blockaid and CertiK reported an apparent exploit of its OLP liquidity vault.
Blockaid estimated the exploit resulted in $18 million in losses, while CertiK placed the figure at about $22 million. Both firms attributed the incident to an apparent compromise of Ostiums oracle system, which supplies external price data to the protocol.
Ostium announced on X that it paused all trading after identifying an issue affecting the vault. It subsequently said: “With user security being our first concern, we recommend that all users temporarily revoke approvals for our contracts until we can further investigate the recent incident.”
The protocol said its team is investigating and has not yet confirmed the cause of the incident or the estimated losses reported by blockchain security firms.
Built on Arbitrum, Ostium is an onchain perpetuals trading platform offering leveraged exposure to 75 trading pairs spanning stocks, ETFs, commodities, indices, foreign exchange and cryptocurrencies.
Related: Crypto hacks fell 47% in H1 but ecosystem is no safer: CertiK
DeFi hacks remain persistent challenge
The incident is the latest in a series of high-profile attacks targeting decentralized finance protocols this year, despite broader efforts to strengthen security across the sector.
According to DeFiLlama, crypto hacks resulted in nearly $630 million in losses during April, the highest monthly total since February 2025. DeFi protocols accounted for the vast majority of those losses, with exploits at KelpDAO and Drift Protocol making up more than 80% of the months total.
Security researchers have said recent DeFi attacks increasingly target offchain infrastructure such as oracle systems, privileged access and key management rather than exploiting flaws in smart contracts alone.
The attacks have also fueled concerns about DeFis readiness for institutional adoption. In an April research note, JPMorgan analysts said bridge security remains a key challenge for the sector, raising questions about whether DeFi can scale to support broader institutional participation.
Industry executives have warned that shrinking DeFi yields are making security risks harder to justify. Speaking to Cointelegraph in May, the CEO of smart contract security firm Statemind and Symbiotic co-founder, Misha Putiatin, said institutions increasingly struggle to quantify hack risk, making them less willing to accept the sectors returns despite growing interest in blockchain-based finance.