Ostium launches recovery plan for $23.75M exploit with 90% of wallets eligible for full repayment

Ostium has launched a recovery portal for liquidity providers affected by its $23.75 million July exploit, with more than 90% of impacted wallets eligible to recover their verified losses in full.

The perpetuals trading platform said it identified 3,666 wallets holding positions in its Ostium Liquidity Pool at the time of the July 15 attack. Of those, 3,321 wallets, or 90.59%, qualify for full recovery under the first stage of the plan.

Users who lost 1,000 USDC or less can now claim the entire amount through the recovery portal. Those claims would total roughly 302,796 USDC if every eligible user participates.

Larger holders face a different choice. Users with losses above 1,000 USDC can either take an immediate 1,000 USDC payment and waive the remainder of their recovery allocation, or remain in a second-stage program that will distribute recovered funds on a pro-rata basis.

Ostium said it has recovered 649,967 USDC from the attacker so far. Additional assets recovered through investigations, law enforcement, exchanges or other counterparties will flow into the second-stage recovery pool.

The protocol will also dedicate a portion of future revenue to those holders, though Ostium has not yet disclosed the percentage or mechanics. 

Further details are expected before an October 30 deadline for larger holders to choose between the immediate payment and Stage 2.

The plan comes more than two months after an attacker compromised Ostium’s offchain pricing infrastructure and submitted fraudulent BTC-USD price reports, generating artificial trading profits that were ultimately paid out of the OLP vault. 

Ostium’s later postmortem put the total loss at $23.75 million and said its smart contracts and protocol multisigs had not been compromised.

Ostium now says evidence from its investigation suggests the attack was carried out by a state actor, though it has not publicly identified the suspected party.

Trading resumed on July 23 after the protocol migrated to new infrastructure and introduced additional security controls.

OLP holders currently retain a pro-rata claim on the assets left in the vault, which Ostium values at about 30% of their pre-incident holdings. Regular settlements have resumed, new deposits remain disabled and withdrawals are being processed on a T+3 schedule.

Ostium said withdrawing the remaining OLP position will not affect eligibility for the recovery program.

The company has also tightened controls around critical keys, production access and circuit breakers while expanding external security reviews. It continues to work with investigators and law enforcement to trace the remaining stolen assets.

Before the exploit, Ostium had processed more than $50 billion in cumulative trading volume and had recently partnered with Nasdaq to use its market data for equity perpetual products. 

The company has raised $27.8 million from investors including General Catalyst, Jump Crypto and Coinbase Ventures.