Real-World Assets, Real Risk

RWA protocols are bringing the world's markets onchain to settle stocks, forex, commodities, treasuries and more. This only works if protocols can safely connect NAV updates and traditional market pricing onchain with secure oracles. Lately, oracle-related losses have been on the rise.

The latest came on July 15, 2026, when Ostium, an RWA perps DEX on Arbitrum, lost $23.75 million from its liquidity vault in minutes. No contracts were broken; the attacker gained access to privileged roles in Ostium's in-house price feed infrastructure. As smart contract security has improved, attackers are increasingly going after the underlying economic assumptions instead.

RWA Oracle Risk

Secure datafeeds exist for a wide variety of established onchain assets, where numerous trusted price feeds are aggregated to provide data that's difficult to manipulate. In contrast, RWAs often use centralized price feeds, like we saw in the Ostium exploit. Protocols that offer exposure to real-world markets have to import prices through a proprietary pipeline of offchain machinery: signers, keepers, commercial APIs, wrappers, NAV feeds. Each link in that chain is a potential single point of failure. 

There can also be timing risks. Real-world markets keep office hours (equities close at 4pm, forex takes weekends off) while DeFi doesn't. Feeds can go thin or stale at precisely the moments leveraged positions need them most. Synthetix learned this back in June 2019, when one of only two commercial APIs behind its Korean won feed began printing values inflated 1,000x and a trading bot turned the error into over $1 billion in synthetic profits within an hour. The funds were returned under a bounty agreement, but the weakness was structural. 

5 Minutes, $23.75 Million

Ostium runs on Arbitrum and lets traders take leveraged synthetic positions on forex, commodities, indices, stocks, and crypto, all settled in USDC against the Ostium Liquidity Pool. Prices reach the protocol through a custom oracle system with two privileged roles. Authorized signers produce price reports, and registered PriceUpKeep forwarders push them onchain, where a verifier recovers each signature and checks it against an approved list.

According to Blockaid's analysis, the attacker held both roles, and Ostium's investigation points to compromised offchain infrastructure in the system that feeds prices into the protocol. Between 14:18 and 14:23 UTC, the attacker submitted future-dated, validly signed reports and ran roughly 20 open-and-close trading loops against them, booking artificial profits with no real market exposure. 

Trader collateral sits in separate contracts and wasn't touched. The loss landed on the liquidity providers. Ostium paused trading within the hour, froze contracts, and brought in Mandiant, zeroShadow, Collisionless, and SEAL 911 alongside law enforcement. A relaunch is being prepared while fund tracing continues.

The Price Is the Risk

Two weeks earlier, Edel Finance showed another example of pricing risk. Its lending market accepted wGOOGLx, a wrapped version of tokenized Alphabet stock, as collateral. The Chainlink feed reporting Alphabet's share price was accurate. The attacker instead manipulated the exchange rate between GOOGLx and its wrapped form, inflating the vault-share price by roughly 78x its real worth, and borrowing real assets against it. Edel absorbed $403,000 in bad debt to make depositors whole.

Even though the underlying oracle was accurate, the failure sat one layer down in the ERC-4626 vault wrapper that held the GOOGLx assets. Wrappers or tokenized equities add conversion steps between an asset and its price, and each one is a potential weakness.

Sometimes the pricing failure can be human. In November 2025, Stream Finance disclosed a $93 million loss in assets run by an external fund manager, Elixir's deUSD lost its peg and fell more than 97%, and the stablecoin was wound down entirely. No oracle malfunctioned and no contract was exploited; opacity in offchain asset management was responsible for the damage. Nexus Mutual paid nearly $100,000 in claims to members holding cover across Rings, Beefy, Harvest, and Euler v2 vaults, which had exposure to Stream in the aftermath.

Does Nexus Mutual Cover This?

When the root cause sits in the price feed, Protocol Cover is there to help. Oracle manipulation, where an attacker distorts a price through trading activity, is a defined risk under the Protocol Cover wording. Oracle failure, where the feed itself malfunctions, misconfigured oracles and other onchain oracle risks are also covered.

Custom infrastructure isn't a barrier to cover either. RWA protocols rarely run off-the-shelf feeds, and our risk team reviews each design on its own merits before a listing goes live. For funds and protocols whose RWA exposure doesn't fit a standard product, Nexus Mutual structures bespoke cover priced to the specific setup.

Operational Security Risk

The gap that remains is operational security. Key management, signer infrastructure, and internal access controls can't be read from the chain, which makes failures like Ostium's hard to underwrite without a verifiable standard. That's why we've been working with experts at the Security Alliance, the group behind SEAL 911, on a cover product for teams that certify against industry best practices and stay in compliance.

You're Covered with Nexus Mutual

RWAs are some of the fastest-growing markets in crypto, and every new tokenized stock, currency pair, and commodity adds another pipeline between an offchain price and onchain capital. Nexus Mutual has been covering crypto since 2019, and oracle and infrastructure design sit at the center of every listing decision we make. 

If you're an investor, fund manager, or protocol builder looking for onchain cover, get in touch with our team.