Invest1 publisher2 min readPublished
After a $23.75 million oracle-credential drain, Ostium rebuilds its trading stack around Gateway
Ostium is rebuilding its trading stack around Gateway, three months after an attacker holding legitimate oracle-signer credentials drained $23.75 million. The new system has to keep execution fast enough for institutional hedging and also show that stolen credentials can no longer push a false price through.
The Investor · Invest desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Galaxy Research says the attacker used an approved oracle signer key and a registered PriceUpKeep forwarder to get a later-timestamped price report verified.
- Ostium's verifier checked whether the signer was authorized but did not test whether the price itself was valid, according to Galaxy.
- The USDC left in eight transactions to a single wallet, the largest of them an atomic run of repeated open-and-close trades against the false price.
- Ostium says Gateway keeps the institutional connectivity it added earlier this year while reworking how execution and margin are handled.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost Credential and infrastructure failures carried most first-half hack losses, so Gateway's key controls will matter more to depositors' expected losses than its speed and margin features.
- constraint Galaxy rules out throttling withdrawals, so Ostium's remaining fixes have to act before a trade settles, where they run up against a sub-100-millisecond execution design.
- exposure OLP depositors still waiting on repayment carry Gateway's launch risk, because Ostium's own September 30 recovery update links repaying the pool to the rebuild.
TRM Labs counted 207 hacking incidents and $972 million in losses in the first half of 2026. It put infrastructure and operational breaches at around 15% of incidents but about 76% of losses [13]. That means roughly 31 incidents lost about $739 million, close to $24 million each [2]. The other 176 or so averaged about $1.3 million [3]. Ostium's July drain came just after TRM's window closed, and its size lands almost exactly on that infrastructure average [4].
Galaxy's prescription is stronger signer-key management, verifier redundancy and admin timelocks [12]. It argues against slowing withdrawals. "Throttling withdrawals introduces censorship risk directly at the application layer," Galaxy Research wrote [11]. I'd expect verifier redundancy to be the fix that costs speed, because a second check would sit in front of every accepted price. Ostium's execution layer was designed for latencies under 100 milliseconds, according to Marco Antonio Ribeiro, the company's co-founder and CTO [5].
Gateway's promised built-in security [1] might include a price-validity check and a second verifier. In that case the rebuild fixes the cause Galaxy found. If Gateway is mostly faster execution and unified margin, traders who want speed can go elsewhere: CoinMarketCap says centralized exchanges are taking a bigger share of RWA-perp trading [17]. A third possibility is that volume grows fast enough for traders to stop pricing in the July drain. CoinMarketCap puts cumulative RWA-perp volume at $3.16 trillion through August 31, with August alone at $799.5 billion, about a quarter of the total [14][5]. DefiLlama showed $5.34 billion of open interest across 1,037 markets on October 1, and that count leaves out centralized exchanges by default [16].
Until Ostium publishes more, I'd treat Gateway as the second case. In its October 1 post on X, the company said Gateway was more than a patch [4]. The connectivity it is keeping sends on-chain orders to off-chain institutional partners for hedging [5]. Galaxy's wider argument is that attackers go after the people, credentials and infrastructure around smart contracts even when the contracts work as intended [10]. I would be wrong if Ostium publishes a design where a stolen signer key and forwarder cannot get a price accepted without an independent check. Cryptopolitan's account of the post does not say whether the verifier will now test the price as well as the signer.
What to watch
- Gateway technical documentation showing whether a price report now needs an independent check or a second signer before trades settle against it.
- The terms and pace of the OLP repayment Ostium tied to the rebuild in its September 30 update.
- CoinMarketCap's next RWA-perp share figures, to see whether centralized exchanges keep gaining after Gateway goes live.