Ostium Recovery Plan Repays 3,321 Wallets In Full, Leaves 345 To Choose

Ostium published a two-stage recovery plan on Wednesday for the 3,666 wallets that lost money when an attacker drained its liquidity vault on July 15, and opened a portal for holders to claim.

The plan resolves almost every affected wallet by count and a small share of the money. Stage 1 repays 3,321 wallets, 90.6% of those affected, in full on Wednesday through what Ostium calls a Convenience Recovery Contract. Those wallets lost $1,000 or less each, which caps the tranche at $3.32 million against the $23.8 million taken.

The other 345 wallets, each of which lost more than $1,000, elect either a $1,000 payment or a pro-rata share of Stage 2. Ostium will fund Stage 2 from money recovered from the attacker, a share of protocol revenue, and what it describes as potential further benefits. The company says full Stage 2 detail will be released progressively before the election deadline, and has not set out the revenue-share percentage, the deadline date, or what the further benefits are.

Ostium has recovered 649,967 $USDC from the attacker so far, 2.7% of the loss. The vault held 32.7 million $USDC immediately before the first attack transaction and 8.96 million $USDC after the last one, Arbitrum data from the Ostium Liquidity Pool (OLP) contract shows. That leaves 27.4% of the vault. Ostium puts the figure at about 30% of pre-incident holdings.

Funding Stage Two

Recovered attacker funds depend on tracing that Ostium said in its post-mortem it will not report on publicly: “We are not publishing live tracing balances or detailed attribution because doing so could compromise the investigation or recovery effort.” The $USDC was converted to ETH and moved across wallets, protocols and chains, with a substantial portion sent through Tornado Cash.

Ostium generated $87,800 in fees over the past 30 days, of which $33,600 was protocol revenue, DefiLlama data shows. Perpetual futures volume over the same period was $169 million, and open interest was $10.4 million.

Sixty-Nine Percent Down

Liquidity providers who never withdrew carry the loss in the share price. OLP was worth 1.10 $USDC before the attack and is worth 0.337 today, a 69.3% decline, according to the vault contract’s own accounting. Supply has fallen from 29.8 million OLP to 19.3 million as providers redeemed.

Value locked across the protocol stands at $8.8 million, down from $63.8 million the day before the attack.

Senior Tranche, Junior Buffer

Ostium’s documentation describes OLP as the senior loss position in a two-tranche vault, protected by a buffer of capital posted by Ostium affiliates and strategic partners. “OLP capital is the last pool of money to take a loss in the system,” it reads. “The only way OLP takes a loss is if the entire buffer is wiped out first.”

The attack did not run through that waterfall. The attacker submitted unauthorized BTC-USD price reports of $5,000 and $60,000, opened and closed positions against them inside the same transaction, and collected the difference as trader profit, which the OLP vault pays out directly. Ostium restructured the vault when it launched an institutional hedging layer on April 28, routing net directional trader flow to Jump and prime brokers off-chain.

Sixty-Three Days Later

Ostium halted trading on July 15, executing its first containment transaction 37 minutes after the attack began and freezing all trading contracts by 15:14 UTC. Trading reopened on July 23 on migrated infrastructure with multi-party approvals for off-chain systems. The post-mortem went up on July 29 and closed on the recovery plan: “We are finalizing a recovery plan for liquidity providers, which we will share in the coming days.” Wednesday is 63 days later. Ostium has not posted on X since.

Ostium found no evidence that the attack came from a flaw in its smart-contract code or a compromise of the multisigs that govern the protocol, according to the post-mortem. The initial access was off-chain. Mandiant ran the forensic investigation, with SEAL 911, zeroShadow, Collisionless and Inca Digital on tracing and incident response.

Ostium Labs raised $24 million in December 2025 at a roughly $250 million valuation, co-led by General Catalyst and Jump Crypto, according to the company. Wintermute Ventures, Coinbase Ventures and Crucible Capital also took part. Total funding stands at $27.8 million. Ostium has not issued a token.