Ostium Vault Hit by $18M Exploit on Arbitrum

An apparent $18 million exploit at an Arbitrum-based vault tied to RWA perpetuals protocol Ostium is drawing fresh attention to DeFi's lingering oracle and execution risks. The incident comes even as institutional crypto adoption and regulatory efforts continue to accelerate across major markets.

Security firm Blockaid flagged "suspicious exploit activity" involving an Ostium vault on Wednesday UTC, according to reports circulated by Wu Blockchain. Blockaid said the attacker appears to have leveraged a registered 'PriceUpkeep' forwarder and an oracle report that had been approved for a future timestamp, allegedly manufacturing artificial trading profits that triggered roughly $18 million in USDC payouts from the vault.

Transaction details and the attacker's address have been published. The incident remains under investigation. Ostium, which offers RWA-linked perpetual futures exposure to markets such as equities, commodities, and FX, has previously raised around $27.8 million from backers including General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR.

The suspected exploit arrives as U.S. policy momentum appears to be building. President Trump is expected to meet with U.S. senators on Wednesday Eastern Time to discuss a cryptocurrency 'clarity' bill, Watcher.Guru reported. Coinbase Global Inc. (COIN stock page) Chief Policy Officer Faryar Shirzad struck an optimistic tone on Fox, arguing that "the policy change has already happened" and that the 'Clarity Act' represents an opportunity to cement those shifts into durable law.

Institutional activity in spot ETFs also remained in focus. On-chain data cited by Odaily indicated BlackRock withdrew 2,152 Bitcoin (BTC) – worth roughly $140 million – from Coinbase Prime custody within about an hour. Analysts tracking the flows said such movements often coincide with new BTC being added to iShares Bitcoin Trust (IBIT), rather than routine custody reshuffles.

ETF flows reported for Monday, July 14 Eastern Time, showed continued net inflows. Spot Bitcoin ETFs took in $181 million and spot Ether ETFs brought in $58.34 million, with no outflow recorded that day. BlackRock's IBIT accounted for $139 million of the Bitcoin net inflow, while Fidelity's FBTC drew $21.07 million. The entirety of Ether inflows was attributed to BlackRock's ETHA.

Beyond the U.S., regulatory frameworks continued to evolve. In South Korea, the Financial Services Commission said it is pursuing amendments that would allow victims of voice phishing to be reimbursed even when stolen funds have been converted into crypto. Under the proposed rules, victims would generally receive restitution in the 'same asset type and quantity' when frozen assets are crypto, with additional provisions for mixed cash-and-crypto cases based on market prices at the time of the freeze. The updated regime is scheduled to take effect on Oct. 1, with public feedback open through Aug. 24.

In South Africa, crypto exchange Luno filed a formal objection to a proposed amendment to foreign exchange rules that would place digital assets under capital outflow controls, according to Odaily. Luno argued the approach could bypass parliamentary oversight and expose millions of users to expanded enforcement powers, including potential seizure and forced liquidation provisions. The draft reportedly includes penalties of up to five years in prison and fines of roughly $53,000.

Protocol development also advanced. Aave Labs said it has launched Aave V4 on Avalanche (AVAX), marking the protocol's first expansion to an external network after deployment on Ethereum (ETH). The rollout implements Aave's 'core-branch' architecture, designed to isolate risk across liquidity hubs. On Avalanche, the deployment includes a core liquidity hub and three independent markets, including an AVAX-related market and an FX market.

In payments, Visa and analytics firm Artemis said in a joint report that 'AI agent payments' are moving from theory into real-world business deployment. The report distinguished "macro-commerce," where agents handle tasks like bookings and subscriptions, from "micro-commerce," defined as high-frequency software-to-software payments under $1. According to the report, the x402 system has processed about $150 million in payments since launching in May 2025, with activity concentrated on Base, Solana (SOL), and Polygon (POL).

Meanwhile, UK fintech Revolut secured an in-principle approval from Dubai's Virtual Assets Regulatory Authority (VARA) to pursue a virtual asset business in the UAE, Odaily reported. The approval covers brokerage, asset management and investment services, and virtual asset trading services, potentially paving the way for UAE users to buy, sell, and hold digital assets via the Revolut app and the Revolut X platform once full authorization is granted.

DeFi risk remains a gating factor. The suspected $18 million Ostium vault exploit on Arbitrum reinforces that oracle timing, report validity windows, and execution pathways can still be manipulated. Institutional flows continue to validate BTC and ETH access rails. BlackRock-related custody movements and reported ETF net inflows for July 14 suggest demand remains resilient and is increasingly expressed via regulated wrappers rather than direct onchain exposure.

Regulatory "clarity" is becoming the macro narrative. U.S. discussion of a 'clarity' bill and Coinbase's view that policy direction has shifted indicate a market expectation that rules may soon harden. Global regulation is diverging in approach. South Korea's victim restitution framework is consumer-protective and procedural, while South Africa's proposed capital outflow controls signal a more restrictive posture that could increase legal and operational risk for exchanges and users.

Infrastructure innovation is widening crypto's use cases. Aave V4's risk-isolated architecture expansion and Visa and Artemis' "AI agent payments" growth point to continued product-market exploration, even as security and liability questions persist.