Ostium recovery plan repays 3,321 wallets in full, leaves 345 to choose

Ostium, the perpetuals protocol built on Arbitrum, has moved to repay 3,321 wallets that lost funds in its July exploit, while presenting 345 remaining affected wallets with a term sheet outlining their recovery options. The distinction between the two groups comes down to scale: smaller depositors are being made whole outright, while larger liquidity providers face a more nuanced path back to their capital.

The recovery framework follows one of the more unusual DeFi exploits this year. On July 15, an attacker didn’t crack a smart contract or compromise a multisig. Instead, they infiltrated Ostium’s off-chain infrastructure and submitted fraudulent BTC-USD price reports, effectively tricking the protocol into releasing funds it shouldn’t have. Eight bogus transactions later, 23,752,746 USDC had walked out the door.

The damage was confined to Ostium’s off-chain liquidity provider (OLP) vault, which is where users deposit USDC to serve as counterparty liquidity for traders on the platform. Trader collateral itself was never at risk, a small mercy that allowed Ostium to resume trading operations on July 23, just eight days after the breach, following a migration to what the team described as a more secure environment.

Ostium Labs has committed to contributing from its own balance sheet to cover losses for affected liquidity providers. The remaining 345 wallets received a term sheet on August 29 outlining their options.

Complicating matters further is a parallel legal battle. The Ostium Foundation is embroiled in litigation over a $15 million USDC loan default, an entirely separate issue that nonetheless puts additional pressure on the entity’s financial resources at exactly the wrong time.

Following the security incident, Ostium initiated a forensic investigation alongside specialized firms including Mandiant and zeroShadow. The breach revealed vulnerabilities not in the on-chain code but in off-chain processes, including the infrastructure responsible for feeding price information to the protocol.