Loading story…
Ostium said an attacker stole $23.75 million from its liquidity provider vault after compromising the off-chain infrastructure that supplied price data to the Arbitrum-based decentralized trading platform. According to the company, the attacker submitted manipulated price reports that appeared legitimate, then rapidly opened and closed large positions to generate artificial profits. Ostium said trader collateral was not affected because it is held in a separate contract, and existing positions remain recorded but frozen while trading is paused.
The platform said it halted trading within about an hour of the first exploit transaction, notified relevant authorities, and plans to publish a post-mortem before restarting services. Blockchain security reporting indicated the stolen USDC was swapped for 12,080 ETH, with 10,540 ETH later deposited into Tornado Cash, complicating efforts to trace and recover the funds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A November 2025 Zellic audit warned that a compromised forwarder could create the kind of price-delivery risk later used in the Ostium exploit. The report says Ostium fixed only the specific example and did not expand its review or bug bounty coverage to the broader risk class.
Ostium said it will reopen trading on July 23 after the exploit-related pause. The protocol said positions and pending orders will carry over and be marked to the live market price at reopening, while new OLP liquidity-provider deposits will remain paused during recovery.
Blockchain security reporting indicated the stolen USDC was converted to Ethereum, with 12,080 ETH obtained and 10,540 ETH later deposited into Tornado Cash.
Ostium said it paused trading within 60 minutes of the first exploit transaction and notified relevant authorities. The platform also stated that trader collateral was unaffected because it is held in separate contracts, while existing positions were frozen pending a restart notice and post-mortem.
Ostium disclosed that an attacker compromised the off-chain infrastructure supplying price data, submitted fraudulent price reports that appeared legitimate, and used them to open and close large positions for artificial profits, stealing $23.75 million from the liquidity provider vault.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcecysecurity.news
Open sourcethedefiant.io
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
THORChain disclosed that one of its six Asgard vaults was compromised, enabling unauthorized outbound transactions before the network halted signing activity. Loss estimates ranged from about **$10.7 million** to more than **$11 million**, with stolen assets taken across at least nine blockchains including **Bitcoin, Ethereum, BNB Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP**. Investigators said the attacker initially dispersed funds across multiple chains and later consolidated proceeds into a two-address cluster, while THORChain said automated detection helped stop additional transfers. The root cause remained under investigation, with THORChain examining possible issues in the `GG20` implementation layer as well as potential infrastructure or operational compromise affecting node operators. The protocol paused signing-related churn activity, delaying validator rotation and other operations, and asked operators to review infrastructure, key management, and Bifrost logs tied to the affected vault. TRM Labs said no actor had been attributed at publication time, but urged compliance teams to quickly screen counterparties and flag deposits linked to tagged addresses as the stolen funds continue to move.
Jun 29, 2026
THORChain was exploited across Bitcoin, Ethereum, BNB Chain, and Base, with losses rising from an initial estimate of **$7.4 million** to more than **$10.7 million** after an Asgard vault was drained. The protocol paused trading after the attack, and community investigators published suspected theft addresses on Bitcoin and EVM-compatible networks. Separately, Alephium disclosed that its private Wormhole-fork TokenBridge was exploited on Ethereum and BNB Chain for about **$815,000** after an off-chain backend flaw let forged guardian messages pass through its four-guardian system, enabling the minting of **13.76 million** unbacked wrapped `ALPH` on Ethereum. New reporting tied the THORChain incident to a privately disclosed but allegedly unremediated proposer-forgery flaw in the Bifrost attestation system. Security firm **V12** said it warned THORChain about a critical fund-draining bug, but the protocol silently patched code, did not pay a bounty, and retired its bug bounty program; researchers said a May 6 fix intended to block proposer forgery failed automated testing and was never deployed before the exploit. In Alephium’s case, the project and Blockaid revised earlier claims of guardian key theft and said the root cause was forged malicious events or messages observed and signed because of a backend vulnerability; Alephium shut down the bridge, halted new transactions, and urged holders to pull liquidity from Uniswap and PancakeSwap while the attacker still controls the unbacked tokens.
Jun 29, 2026
Polymarket said attackers stole funds from an undisclosed number of users after compromising a third-party vendor and injecting malicious code into the company's website. The platform said the incident has been contained, affected customers are being notified, and victims will be fully reimbursed. A company spokesperson confirmed the theft but did not disclose how many users were impacted. Independent blockchain researchers described the activity as a phishing-style campaign that drained more than 11 Polymarket wallets holding **PUSD**, with estimated losses of about **$2.94 million to $3 million**. Researchers also reported that the attacker moved the stolen assets from **Polygon** to **Ethereum** and converted them into roughly **1,893 ETH**, indicating a rapid effort to launder the proceeds after the website compromise.
Jun 29, 2026