Ostium, a decentralized perpetuals trading protocol built on Arbitrum, has paused all trading after security firms reported what they described as an exploit tied to the protocol’s OLP liquidity vault. Blockaid and CertiK both said the incident appeared to stem from a compromise of Ostium’s oracle infrastructure, which feeds external price data into the platform.

Blockaid estimated losses at around $18 million, while CertiK put the figure closer to $22 million. Ostium said it identified an issue affecting the vault and is investigating, but it has not yet confirmed the cause or independently verified the loss estimates.

Key takeaways

• Ostium paused trading after reporting an issue in its OLP liquidity vault.
• Two security firms diverged on losses: Blockaid estimated ~$18M; CertiK estimated ~$22M.
• The suspected root cause is oracle compromise, according to Blockaid and CertiK.
• Ostium urged users to revoke approvals for its contracts while it investigates.

Trading halted and user action requested

On X, Ostium announced it was pausing all trading after identifying a problem affecting the vault. In a subsequent update, the protocol recommended that users temporarily revoke approvals for its contracts “until we can further investigate the recent incident,” framing the guidance around user security.

Ostium’s statements indicate the team has not concluded what happened. The protocol also said it is still investigating the matter and has not confirmed the precise cause behind the exploit or the size of the losses referenced by external security firms.

For traders and liquidity providers, these steps matter because approval management can be directly relevant to how funds could be moved or accessed by smart contracts. Until the protocol provides a more detailed technical assessment, users are essentially operating on partial information—security firm analysis on one side and Ostium’s ongoing review on the other.

Security firms point to oracles, not just smart-contract bugs

Blockaid and CertiK attributed the apparent incident to a compromise of Ostium’s oracle system. Oracles are the mechanism that translates external data—commonly asset prices—into onchain inputs. When an oracle is manipulated or fails, it can distort how a protocol prices assets or calculates settlement conditions, potentially enabling exploits even when core smart contracts are functioning as designed.

Blockaid’s estimate of roughly $18 million in losses and CertiK’s estimate of about $22 million underline that there may be uncertainty in how the damage is measured—particularly in DeFi incidents where attackers can move funds across multiple steps and venues before or after the exploit is detected.

The gap between the estimates also signals why protocols tend to pause operations quickly: with incomplete visibility, the safest near-term action is to stop new trading activity while the affected contracts and oracle pathways are examined.

What Ostium offers—and why the vault issue is central

Ostium is an onchain perpetuals platform for leveraged trading, offering exposure to 75 trading pairs across categories that include stocks, ETFs, commodities, indices, foreign exchange, and cryptocurrencies. Its deployment on Arbitrum places it within the broader wave of offchain-scale improvements offered by Ethereum-compatible networks, but security remains a cross-chain concern: the protocol’s onchain design still depends on offchain components such as oracle data.

The reported issue is specifically linked to Ostium’s OLP liquidity vault. Liquidity vaults are typically used to manage pooled assets that can back trading positions and related settlement flows. If an oracle compromise leads to incorrect accounting—such as mispricing, liquidation logic manipulation, or unfair transfers—vaults can become the conduit through which value is extracted.

DeFi hacks keep targeting infrastructure

The Ostium halt is another reminder that DeFi incidents continue to be persistent even as the industry invests in security tooling and formal best practices. DeFiLlama data cited by Cointelegraph indicated that crypto hacks caused nearly $630 million in losses during April, the highest monthly total since February 2025. DeFi protocols accounted for the majority of that figure, with exploits at KelpDAO and Drift Protocol contributing more than 80% of the April total.

In recent research and commentary, security observers have argued that the threat focus is shifting. Instead of only exploiting weaknesses in smart contracts directly, attackers increasingly go after offchain infrastructure—particularly oracle systems, privileged access controls, and key management processes. That pattern aligns with the Ostium incident as described by Blockaid and CertiK.

Concerns extend beyond immediate technical risk. The repeated occurrence of these incidents has fed questions about whether DeFi is ready to support institutional participation at scale. Earlier coverage highlighted that bridges and other connecting components remain a major security challenge for the sector, and that scaling DeFi for broader adoption requires more than yields—it requires credible operational resilience.

There are also economic constraints. As Cointelegraph previously reported, shrinking DeFi yields can make security costs harder to justify, and institutions may struggle to quantify hack risk versus expected returns. In a May conversation cited by Cointelegraph, the CEO of smart contract security firm Statemind and Symbiotic co-founder Misha Putiatin said institutions increasingly find it difficult to price hack risk, which can reduce appetite for sector exposure despite rising interest in blockchain-based finance.

What to watch next

Investors and users should monitor whether Ostium releases a fuller incident report that clarifies how the oracle system was compromised, which contracts or components were affected, and whether user funds remain recoverable. Equally important will be whether the protocol updates its oracle design or control mechanisms to prevent recurrence—and how quickly trading and liquidity operations can safely resume.

Investment giant Cantor Fitzgerald and cryptocurrency-focused broker-dealer Securitize (SECZ), are revamping initial public offerings (IPOs) with tokenization and blockchain technology, the companies said on Wednesday.

Under the agreement, Cantor will leverage its equity capital markets and trading capabilities, while Securitize will provide the tokenization infrastructure used to issue, distribute, and service tokenized securities, according to a press release.

Large traditional finance players are taking rapid steps towards the tokenization of capital markets. This week the Depository Trust & Clearing Corporation (DTCC) announced further plans to tokenize stocks with a range of partners including JPMorgan, Goldman Sachs, BlackRock and Vanguard.

The collaboration will enable public companies to raise capital and issue securities onchain with improved operational efficiency and modernized ownership records, while still operating within the established capital markets framework of traditional public offerings, the companies said.

Rather than focusing on tokenized funds or secondary trading, this partnership extends blockchain infrastructure directly into IPOs and follow-on offerings, a Securitize spokesperson said in an email.

XRP Ledger has entered the final two-week activation countdown for its fixCleanup3_2_0 amendment after validator support exceeded the network’s required 80% approval threshold.

According to XRP Ledger governance data, the bundled maintenance amendment currently has 85.71% validator support, with 30 validators voting in favor and five against.

Under the network’s governance rules, an amendment must maintain at least 80% support for two consecutive weeks before it can be activated on the mainnet. If support drops below that level during the countdown, the activation timer resets.

Validator approval has moved the amendment into its final activation stage

With the voting threshold now secured, the amendment has entered its activation phase and is currently scheduled to go live on July 29, 2026, at 09:57 UTC, provided validator backing remains above the required level throughout the waiting period.

XRPL validator Vet shared the update on X, noting that fixCleanup3_2_0 is now in its two-week activation window. Vet also said node operators will need to update their software before the amendment becomes active to ensure compatibility with the protocol changes.

Unlike feature-focused upgrades, fixCleanup3_2_0 combines several maintenance fixes into a single amendment. The package addresses precision and rounding issues affecting Single Asset Vaults and the Lending Protocol while also correcting behavior in Permissioned Domains and the Permissioned DEX introduced alongside XRPL v3.2.0.

Additional protocol changes validate non-canonical Multi-Purpose Token (MPT) amounts, introduce zero DomainID verification for permissioned domains, and correct an invariant governing valid Permissioned DEX offer deletions. The amendment also adds another ledger invariant designed to prevent account deletions from leaving directly accessible artifacts behind.

By grouping multiple maintenance updates into one amendment, the XRP Ledger governance process requires validators to approve a single package instead of voting on several independent protocol changes.

Recent ecosystem growth has expanded activity around the network

The maintenance vote comes as development activity on XRP Ledger continues to expand beyond core protocol updates. Earlier, the network surpassed 1 million AI-powered payments processed through the x402 protocol, highlighting increasing use of AI-enabled payment applications.

Ripple-backed t54.ai recently launched the XRPL AI Hub, a platform that brings together AI projects, autonomous agents, developer tools, payment services, and technical documentation in one place.

According to t54.ai, the hub was introduced with support from Ripple developers and the XRP Ledger Foundation to help developers discover and build AI applications on the XRP Ledger.

Although the AI Hub launch is separate from the fixCleanup3_2_0 amendment, both developments arrive as the network continues improving infrastructure for decentralized finance, tokenization, permissioned trading, and AI-powered payment services.

If validator support remains above the required threshold until the end of the activation window, fixCleanup3_2_0 will become the latest protocol update added to the XRP Ledger without requiring another round of governance voting.

Securitize and Cantor Fitzgerald have partnered to support blockchain-based initial public offerings (IPOs) and follow-on equity offerings for listed companies, a move that could further expand the use of tokenized securities in traditional capital markets.

The companies said Wednesday that they are developing a framework for primary issuances that would allow companies to raise capital through tokenized securities while remaining within the existing regulatory framework for public offerings. The framework would support both IPOs and follow-on, or secondary, offerings, in which already public companies issue additional shares to raise capital.

Under the agreement, Securitize will provide the tokenization infrastructure used to issue, distribute and service the digital securities. Its SEC-registered broker-dealer affiliate, Securitize Markets, will participate in the offering and settlement process. Cantor will contribute its equity capital markets and trading capabilities typically associated with public offerings. 

The announcement comes as tokenized securities gain traction across traditional finance. While tokenization has largely focused on private credit and Treasurys, companies are increasingly exploring blockchain-based infrastructure for public equities as well.

The collaboration builds on an existing relationship between the companies. Securitize, which provides blockchain infrastructure for tokenized real-world assets, went public through a merger with a special purpose acquisition company (SPAC) backed by Cantor Fitzgerald. 

Related: Kraken acquires tokenization platform Magna ahead of potential IPO

Tokenized stocks attract Wall Street interest

The market for tokenized stocks has expanded rapidly over the past year, outpacing much of the broader digital asset market. The value of tokenized stocks onchain has increased 16% over the past 30 days to nearly $1.9 billion, according to RWA.xyz.

The value of tokenized stocks has grown rapidly over the past year.
Source: RWA.xyz

The growth is drawing established financial institutions deeper into the sector. As The Wall Street Journal reported Wednesday, the Depository Trust & Clearing Corp. (DTCC) plans to pilot the tokenization of stocks and US Treasurys with nearly 40 financial companies, including JPMorgan and Goldman Sachs. The trial follows DTCC’s May announcement that it aims to roll out tokenized trading services by October. 

Assets slated for tokenization include shares of Microsoft (MSFT) and stablecoin issuer Circle (CRCL), as well as exchange-traded funds tracking the S&P 500 index, the Nasdaq 100 index and short-term US Treasury bonds.

Related: US, UK treasuries to align transatlantic rules on tokenization and stablecoins

Decentralized trading protocol Ostium paused trading Wednesday after blockchain security firms Blockaid and CertiK reported an apparent exploit of its OLP liquidity vault.

Blockaid estimated the exploit resulted in roughly $18 million in losses, while CertiK placed the figure at about $22 million. Both firms attributed the incident to an apparent compromise of Ostium’s oracle system, which supplies external price data to the protocol.

Source: Ostium

Ostium announced on X that it paused all trading after identifying an issue affecting the vault. It subsequently said: “With user security being our first concern, we recommend that all users temporarily revoke approvals for our contracts until we can further investigate the recent incident.”

The protocol said its team is investigating and has not yet confirmed the cause of the incident or the estimated losses reported by blockchain security firms.

Built on Arbitrum, Ostium is an onchain perpetuals trading platform offering leveraged exposure to 75 trading pairs spanning stocks, ETFs, commodities, indices, foreign exchange and cryptocurrencies.

Source: CertiKAlert

Related: Crypto hacks fell 47% in H1 but ecosystem is no safer: CertiK

DeFi hacks remain persistent challenge

The incident is the latest in a series of high-profile attacks targeting decentralized finance protocols this year, despite broader efforts to strengthen security across the sector.

According to DeFiLlama, crypto hacks resulted in nearly $630 million in losses during April, the highest monthly total since February 2025. DeFi protocols accounted for the vast majority of those losses, with exploits at KelpDAO and Drift Protocol making up more than 80% of the month’s total.

Security researchers have said recent DeFi attacks increasingly target offchain infrastructure such as oracle systems, privileged access and key management rather than exploiting flaws in smart contracts alone.

The attacks have also fueled concerns about DeFi’s readiness for institutional adoption. In an April research note, JPMorgan analysts said bridge security remains a key challenge for the sector, raising questions about whether DeFi can scale to support broader institutional participation.

Industry executives have warned that shrinking DeFi yields are making security risks harder to justify. Speaking to Cointelegraph in May, the CEO of smart contract security firm Statemind and Symbiotic co-founder, Misha Putiatin, said institutions increasingly struggle to quantify hack risk, making them less willing to accept the sector’s returns despite growing interest in blockchain-based finance.

Magazine: Strategy became a symbol of the dot-com crash: Could history repeat?

Institutional crypto OTC markets are evolving beyond block trades as firms demand liquidity, settlement, and cross-border infrastructure services.

For most of its early history, the institutional crypto OTC market was defined by a single problem: how to move large blocks of Bitcoin or Ethereum without those orders moving the market against themselves. OTC desks existed to solve that problem, and the mechanics were straightforward. A desk aggregated liquidity across venues, quoted a price, and settled the transaction off-exchange. That was the value proposition, and for the institutions active in the market at the time, it was sufficient.

The market that exists today is considerably more complex. The institutions using OTC infrastructure now range from payment companies running millions of stablecoin conversions per month to sovereign wealth funds building digital asset exposure to regional exchanges managing fiat liquidity across multiple jurisdictions simultaneously. Their requirements go well beyond block execution, and the desks serving them have had to evolve accordingly. Understanding how that evolution unfolded and what it means for institutions evaluating OTC partners today is increasingly important as off-exchange activity accounts for a larger share of total institutional crypto volume.

From block trading to execution infrastructure

The original institutional OTC use case was straightforward: an investor wanted to acquire or liquidate a significant position in Bitcoin or Ethereum, and the depth available on public exchange order books at any given moment was insufficient to absorb the order without meaningful price impact. OTC desks solved this by aggregating liquidity from multiple venues simultaneously, executing the full position off-exchange at a single blended rate. The client received a cleaner outcome than exchange execution could deliver at a comparable size, and the desk managed the inventory risk.

As institutional participation broadened, the use cases multiplied faster than most desks anticipated. Payment companies discovered that stablecoin-to-fiat conversion at scale required the same off-exchange execution logic as block trades, but at far higher frequency and with much tighter settlement timing requirements. Mining operations needed to convert consistent production volumes without compressing spot prices on public markets. Funds allocating across a broader digital asset universe needed OTC access to assets with limited exchange liquidity. Each of these use cases placed different demands on OTC infrastructure, and the desks that grew with their clients were the ones that treated execution as a starting point rather than an end product.

The shift from block trading to execution infrastructure represents the most significant structural change in the institutional OTC market over the past several years. A desk operating as execution infrastructure is not just quoting prices on large orders. It involves managing settlement rails, maintaining credit relationships, operating compliance frameworks across multiple jurisdictions, and providing the reporting and operational integration that institutional treasury functions require. The technical and operational gap between a desk capable of this and one that handles only straightforward block trades is substantial.

Settlement as the real differentiator

Among the structural changes in institutional OTC, none has been more consequential than the shift in how clients evaluate settlement capability. For the first generation of institutional OTC clients, settlement was binary: did the transaction complete, and did it complete accurately? Speed was a secondary consideration because the use cases did not require it.

For the current generation of institutional users, settlement infrastructure is often the primary criterion for evaluation. Payment companies and fintechs running real-time stablecoin conversion flows cannot absorb settlement delays lasting hours. Treasury operations managing liquidity across multiple jurisdictions in different time zones need finality that is reliable rather than probabilistic. Regional exchanges facilitating local fiat pairs need settlement rails that are actually present in their markets rather than routing through correspondent banking chains that add latency and introduce clearing risk.

The desks that have responded to this have built onshore banking infrastructure across the regions where their clients operate, rather than relying on cross-border correspondent relationships to approximate regional settlement. The operational investment required to do this genuinely, with actual banking licenses, compliance infrastructure, and local operational presence, is one of the more significant barriers to entry in the institutional OTC market today. Recent developments reinforce why this matters: central banks moving to blockchain-based settlement rails is raising the baseline of what institutional settlement infrastructure is expected to deliver, making the gap between desks with genuine regional presence and those with nominal coverage more consequential. It is also one of the reasons that headline spread comparisons between desks are increasingly insufficient as an evaluation framework. A desk offering tight spreads with slow or uncertain settlement is, in practice, more expensive than one offering slightly wider spreads with second-level finality across all relevant markets.

The role of multi-venue aggregation in modern OTC execution

Multi-venue aggregation has always been part of the OTC value proposition, but how it is executed and the depth at which it operates have changed considerably as the crypto market structure has matured. In the early institutional OTC market, aggregation across a handful of major exchanges was sufficient to source competitive pricing on the assets clients needed. As the asset universe expanded and trading activity was distributed across more venues globally, connectivity requirements grew accordingly.

The practical implication is that the quality and quantity of multi-venue aggregation have become a primary differentiator among OTC desks, rather than just a baseline capability. A desk with deep connectivity across a broad network of exchanges can source liquidity and lock pricing for a wide range of digital assets simultaneously, giving clients certainty on the rate before execution begins, regardless of where the underlying liquidity happens to be distributed at that moment. The infrastructure required to deliver this, low-latency connections to a large number of venues, real-time pricing engines operating across all of them, and price-locking mechanisms that hold the rate through execution, represents a meaningful operational investment that separates the leading desks from the rest of the market.

Counterparties offering crypto OTC trading at this level of infrastructure depth provide a fundamentally different execution environment than lighter-touch alternatives. The difference is not primarily visible in a standard spread comparison. It shows up in execution consistency across a wide range of assets, in settlement reliability during volatile market conditions, and in the operational continuity that high-frequency clients depend on when their own business processes are built around it.

Emerging market demand and what it requires

One of the more underappreciated developments in institutional crypto OTC over the past few years has been the expansion in demand from emerging-market participants. Exchanges operating in Southeast Asia, Latin America, and MENA now represent a significant and growing share of institutional OTC activity, and their requirements are specific enough to constitute a distinct market segment rather than a geographic variation of the same use case.

The core challenge for emerging market participants is not execution pricing. Spreads on major pairs are competitive across most institutional desks. The challenge is regional settlement: reliably getting fiat in and out of local markets at speed, without the correspondent banking dependencies that introduce unpredictable latency. An exchange in Southeast Asia managing local fiat pairs needs a counterparty that can settle in the local market in seconds, not one that routes through a chain of correspondent banks and delivers settlement on the following business day.

This requirement has pushed institutional OTC desks toward genuine regional operational presence as a competitive necessity rather than a growth aspiration. The desks with onshore banking infrastructure and compliance frameworks in the markets where their emerging-market clients operate can serve this segment in ways those without it simply cannot replicate at the service levels these clients require. As emerging market institutional participation continues to grow, this regional operational depth is likely to become one of the most important factors in OTC counterparty selection.

How institutional clients are evaluating OTC desks today

The evaluation framework that institutional clients apply to OTC desks has become considerably more sophisticated as their use of OTC infrastructure has deepened. The clients who are now moving the most volume through OTC desks, payment companies, active trading operations, exchanges, and large fund managers have developed detailed views of what genuinely capable infrastructure looks like, and they apply those views when selecting or reviewing counterparties.

Settlement speed and regional coverage have already been discussed, but two additional dimensions are worth examining. Capital structure, specifically whether the desk operates on its own balance sheet or relies on borrowed inventory, shapes how risk is distributed within the arrangement and has direct implications for same-day settlement capability and credit availability. Desks operating on their own institutional capital can hold inventory, extend credit facilities to eligible counterparties, and absorb the timing differences between client execution and position management. These capabilities underpin the kind of operational reliability that high-frequency clients require.

Reporting and integration capability have also emerged as significant evaluation criteria for institutional treasury operations. Clients running high transaction volumes need real-time, granular visibility into execution quality, API integration that removes manual steps from the execution workflow, and operational transparency that enables their finance teams to accurately account for every transaction. Desks that treat reporting as an afterthought are increasingly unsuitable for the more sophisticated segment of the institutional OTC market, regardless of how competitive their pricing appears.

Where the institutional OTC market is heading

Several structural trends are likely to shape institutional crypto OTC over the coming years. Stablecoin adoption by major financial institutions is already changing the settlement economics of cross-border institutional flows, and OTC desks positioned within that infrastructure are likely to see volume growth that differs structurally from traditional block-trading demand. Visa’s CFO recently outlined how stablecoin settlement is reshaping institutional payment infrastructure, a signal that stablecoin-denominated settlement is moving from an emerging capability to an operational expectation across a significant segment of institutional payment flows, with direct implications for the OTC desks serving those clients.

Regulatory development across key markets is creating both clarity and new compliance requirements for institutional OTC operations. Desks with the compliance infrastructure to operate across multiple regulated jurisdictions are better positioned to serve the institutional segment as regulatory frameworks mature, while those without it face increasing friction in markets where institutional participation is growing fastest.

The consolidation dynamic evident in the institutional OTC market over the past few years is likely to continue. The operational investment required to maintain competitive execution infrastructure across a broad asset universe, genuine regional settlement capability, and the compliance frameworks that institutional clients now require is substantial. The desks that have built this infrastructure are pulling further away from those that have not, and the evaluation gap between them is becoming more visible to institutional clients with each passing cycle.

What this means for institutions evaluating OTC partners

The evolution of institutional crypto OTC from a block-trading service to a genuine financial infrastructure has significant implications for how institutions should approach counterparty evaluation. A framework built around spread comparison was adequate when OTC desks were doing a simpler job. It is insufficient for evaluating the kind of operational relationships that institutional crypto participation now requires.

The institutions best positioned in this market have treated their OTC counterparty decision as a strategic infrastructure choice rather than a transactional one, selecting partners with the settlement depth, regional presence, capital structure, and operational integration capability to support their business as it scales. The quality of that decision tends to compound over time. The desks with the right infrastructure today are the ones whose clients transact the most volume, and the gap between them and lighter alternatives is becoming harder to close from the outside.