Ostium vault loses 23.75 million USDC through fraudulent prices; recovery remains incomplete
Attackers stole 23.75 million USDC from Ostium’s liquidity vault; trader collateral was unaffected. Trading resumed, but compensation remains incomplete. Affected vault holders should check the official recovery portal and read its release terms.
If you held Ostium liquidity-vault shares during the theft, check the Recovery Portal at https://app.ostium.com/vault; claims for verified losses of up to 1,000 USDC remain available until 29 December 2026 at 23:59 UTC. Larger holders who did not accept the settlement were due to enter Stage 2 automatically: read the full-release terms before any first redemption, for which Ostium says there is no deadline. Ignore recovery messages asking for your seed phrase, private keys or funds.
What’s happening
An attacker compromised infrastructure outside Ostium’s blockchain contracts and submitted fraudulent Bitcoin prices, taking 23,752,746 USDC from its public liquidity-provider vault on Arbitrum. The loss affected vault investors; Ostium said traders’ collateral remained separate and was unaffected. Trading resumed on 23 July after an infrastructure migration. The financial loss remains unresolved. Ostium reported recovering 649,967 USDC in September and began compensating smaller holders. Its 29 October update said 816 smaller holders had recovered their full losses by 28 October, while 89 larger holders had accepted 1,000 USDC settlements. Stage 2 was scheduled to open on 31 October, funded partly through protocol trading fees, with initial redemptions scheduled for 2 November. The reviewed statements do not confirm those subsequent payments. The investigation continues, and neither full repayment nor the proposed future equity option is guaranteed.
- What
- Breach
- Affects
- Ostium public liquidity-provider vault (OLP) on Arbitrum
- Fixed in
- Nothing to patch
- Since
- 15 July 2026
Timeline
- Vendor revised
Ostium moved the announced Stage 2 opening to 31 October, with approximately 257,000 USDC scheduled for redemption from 2 November. It clarified that the first redemption requires terms including a full release, and that full recovery is not guaranteed.
- Update
Ostium reported 223,383 USDC paid to Stage 1 participants as of 21 October. Its eligibility figures now listed 3,619 wallets, compared with 3,666 in September; the update did not explain the difference.
- Update
Ostium launched its recovery portal and reported recovering 649,967 USDC from the attacker. Holders with verified losses of up to 1,000 USDC could claim full compensation; larger holders could choose 1,000 USDC while waiving further recovery, or enter Stage 2.
- Update
The vault’s first post-incident settlement reflected the theft in its share price. Ostium subsequently valued holders’ remaining vault assets at approximately 30% of their pre-incident holdings.
- Made public
Ostium published its investigation report, attributing the theft to compromised off-chain infrastructure. It said it had found no evidence of a smart-contract logic flaw or compromise of the wallets governing the protocol.
- Update
Trading resumed after Ostium moved to a new production environment with stronger security controls.
- UpdateNothing to patch
An attacker withdrew 23,752,746 USDC from Ostium’s public liquidity vault using fraudulent Bitcoin price reports. Ostium froze all trading contracts by 15:14 UTC; trader collateral was not withdrawn.
Sources
- Ostium Post Mortem: July 15 Incident — Ostium statement reproduced by teapawtOstium · 29 July 2026
- Ostium OLP Recovery Update — Ostium statement reproduced by teapawtOstium · 30 Sept 2026
- OLP Recovery: Stage 1 Update; Stage 2 Opens October 30th — reproduced by teapawtOstium · 22 Oct 2026
- Stage 2 Opens October 31st — Ostium statement reproduced by teapawtOstium · 29 Oct 2026
- Ostium blames off-chain breach for $24 million exploit, rules out smart contract flawThe Block · 30 July 2026
- Hackers steal $23.7 million in crypto from Ostium in off-chain attackBleepingComputer · 20 July 2026