{"id":"ostium-liquidity-vault-theft-jul-2026","category":"breach","status":"live","title":"Ostium vault loses 23.75 million USDC through fraudulent prices; recovery remains incomplete","tldr":"Attackers stole 23.75 million USDC from Ostium’s liquidity vault; trader collateral was unaffected. Trading resumed, but compensation remains incomplete. Affected vault holders should check the official recovery portal and read its release terms.","summary":"An attacker compromised infrastructure outside Ostium’s blockchain contracts and submitted fraudulent Bitcoin prices, taking 23,752,746 USDC from its public liquidity-provider vault on Arbitrum. The loss affected vault investors; Ostium said traders’ collateral remained separate and was unaffected. Trading resumed on 23 July after an infrastructure migration. The financial loss remains unresolved. Ostium reported recovering 649,967 USDC in September and began compensating smaller holders. Its 29 October update said 816 smaller holders had recovered their full losses by 28 October, while 89 larger holders had accepted 1,000 USDC settlements. Stage 2 was scheduled to open on 31 October, funded partly through protocol trading fees, with initial redemptions scheduled for 2 November. The reviewed statements do not confirm those subsequent payments. The investigation continues, and neither full repayment nor the proposed future equity option is guaranteed.","action":"If you held Ostium liquidity-vault shares during the theft, check the Recovery Portal at https://app.ostium.com/vault; claims for verified losses of up to 1,000 USDC remain available until 29 December 2026 at 23:59 UTC. Larger holders who did not accept the settlement were due to enter Stage 2 automatically: read the full-release terms before any first redemption, for which Ostium says there is no deadline. Ignore recovery messages asking for your seed phrase, private keys or funds.","product":"Ostium public liquidity-provider vault (OLP) on Arbitrum","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ostium","arbitrum","crypto","defi","crypto-theft","key-compromise"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Ostium Post Mortem: July 15 Incident — Ostium statement reproduced by teapawt","url":"https://teapaw.org/Ostium/article/2082540358219747422","by":"Ostium","date":"2026-07-29"},{"kind":"post","title":"Ostium OLP Recovery Update — Ostium statement reproduced by teapawt","url":"https://teapaw.org/Ostium/article/2105311865760797178","by":"Ostium","date":"2026-09-30"},{"kind":"post","title":"OLP Recovery: Stage 1 Update; Stage 2 Opens October 30th — reproduced by teapawt","url":"https://teapawt.org/Ostium/article/2113308327513833693","by":"Ostium","date":"2026-10-22"},{"kind":"post","title":"Stage 2 Opens October 31st — Ostium statement reproduced by teapawt","url":"https://teapawt.org/Ostium/article/2115860571249656029","by":"Ostium","date":"2026-10-29"},{"kind":"news","title":"Ostium blames off-chain breach for $24 million exploit, rules out smart contract flaw","url":"https://www.theblock.co/news/ecosystems/2026-07-30-ostium-post-mortem-exploit-410122","by":"The Block","date":"2026-07-30"},{"kind":"news","title":"Hackers steal $23.7 million in crypto from Ostium in off-chain attack","url":"https://www.bleepingcomputer.com/news/security/hackers-steal-237-million-in-crypto-from-ostium-in-off-chain-attack/","by":"BleepingComputer","date":"2026-07-20"}],"started":"2026-07-15","closed":null,"created":"2026-11-03T21:25:40.095Z","updated":"2026-11-03T21:25:40.095Z","cve_notes":[],"timeline":[{"at":"2026-10-29","added":"2026-11-03T21:16:05.524Z","kind":"vendor-revised","text":"Ostium moved the announced Stage 2 opening to 31 October, with approximately 257,000 USDC scheduled for redemption from 2 November. It clarified that the first redemption requires terms including a full release, and that full recovery is not guaranteed.","url":"https://teapawt.org/Ostium/article/2115860571249656029","by":"Ostium (statement reproduced by teapawt)","patch":null},{"at":"2026-10-22","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Ostium reported 223,383 USDC paid to Stage 1 participants as of 21 October. Its eligibility figures now listed 3,619 wallets, compared with 3,666 in September; the update did not explain the difference.","url":"https://teapawt.org/Ostium/article/2113308327513833693","by":"Ostium (statement reproduced by teapawt)","patch":null},{"at":"2026-09-30","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Ostium launched its recovery portal and reported recovering 649,967 USDC from the attacker. Holders with verified losses of up to 1,000 USDC could claim full compensation; larger holders could choose 1,000 USDC while waiving further recovery, or enter Stage 2.","url":"https://teapaw.org/Ostium/article/2105311865760797178","by":"Ostium (statement reproduced by teapawt)","patch":null},{"at":"2026-09-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"The vault’s first post-incident settlement reflected the theft in its share price. Ostium subsequently valued holders’ remaining vault assets at approximately 30% of their pre-incident holdings.","url":"https://teapaw.org/Ostium/article/2105311865760797178","by":"Ostium (statement reproduced by teapawt)","patch":null},{"at":"2026-07-29","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Ostium published its investigation report, attributing the theft to compromised off-chain infrastructure. It said it had found no evidence of a smart-contract logic flaw or compromise of the wallets governing the protocol.","url":"https://teapaw.org/Ostium/article/2082540358219747422","by":"Ostium (statement reproduced by teapawt)","patch":null},{"at":"2026-07-23","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Trading resumed after Ostium moved to a new production environment with stronger security controls.","url":"https://www.theblock.co/news/ecosystems/2026-07-30-ostium-post-mortem-exploit-410122","by":"The Block","patch":null},{"at":"2026-07-15","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"An attacker withdrew 23,752,746 USDC from Ostium’s public liquidity vault using fraudulent Bitcoin price reports. Ostium froze all trading contracts by 15:14 UTC; trader collateral was not withdrawn.","url":"https://teapaw.org/Ostium/article/2082540358219747422","by":"Ostium (statement reproduced by teapawt)","patch":"na"}],"url":"https://hard.fyi/live/ostium-liquidity-vault-theft-jul-2026/","json":"https://hard.fyi/api/live?id=ostium-liquidity-vault-theft-jul-2026"}