GoPlus Security 🚦(@GoPlusSecurity):🚨 GoPlus Security Alert: RWA trading platform @Ostium on #Arbitrum was reportedly exploited due to a suspected admin account private key compromise, resulting in an estimated loss of $11.86M. The attacker first opened a position via openTrade, then manipulated the price through performUpkeep, and finally profited by calling closeTradeMarket. The price submitted in the performUpkeep function requires a signature from an authorized account for verification. The attacker's success suggests the private key of the authorized account (0x38110430184c22d93c30b3e67b9af98d5d0ab8bd) may have been compromised. https://t.co/RgOWF84xFS Attacker addresses: 0x321Df194646029e7A6193Ea05573d4B9c398bfD9 0xD1794196f0fc99c7f27970e661597d77d9a85869 Affected contract: 0x20D419a8e12C45f88fDA7c5760bb6923Cee27F98 Attack transactions: https://t.co/8osddYz8RC https://t.co/RgOWF84xFS https://t.co/DANv9vst1u https://t.co/FtspCp0W9T https://t.co/U44UcRDasB https://t.co/PfIVIIz86o https://t.co/xhVG1IhH0x

2026.07.16 09:51

🚨 GoPlus Security Alert: RWA trading platform @Ostium on #Arbitrum# was reportedly exploited due to a suspected admin account private key compromise, resulting in an estimated loss of $11.86M. The attacker first opened a position via openTrade, then manipulated the price through performUpkeep, and finally profited by calling closeTradeMarket. The price submitted in the performUpkeep function requires a signature from an authorized account for verification. The attacker's success suggests the private key of the authorized account (0x38110430184c22d93c30b3e67b9af98d5d0ab8bd) may have been compromised. Attacker addresses: 0x321Df194646029e7A6193Ea05573d4B9c398bfD9 0xD1794196f0fc99c7f27970e661597d77d9a85869 Affected contract: 0x20D419a8e12C45f88fDA7c5760bb6923Cee27F98 Attack transactions:

Ostium@Ostium

2026.07.16 05:35

A Security Update: Trading remains paused following the security incident. User positions remain open and unmodifiable, and trader margin remains unmoved in frozen trading smart contracts. The team will continue to provide updates as they become available regarding a timeline both to the resumption of smart contract activity and the recovery of funds. Over the past 14 hours, the team has been in continuous coordination with relevant authorities, SEAL 911, and multiple security researchers. Several teams are working full-time to track the movement of funds and support the investigation. We are thankful for the support of countless individuals who have assisted throughout. We remain focused on resolving this incident around the clock and will share further status updates as soon as we are able.