Ostium says offchain breach drained $23.75M from OLP vault using false BTC price reports

According to Ostium's post-mortem, an attacker who compromised off-chain infrastructure submitted unauthorized BTC-USD price reports of $5,000 and $60,000 and repeatedly opened and closed positions against them, draining 23,752,746 USDC from the OLP vault on July 15, 2026. The firm found no smart-contract or multisig vulnerability; trader margin was untouched. Circuit breakers, triggered twice, and a 14:55 UTC containment response limited losses. Trading resumed July 23 after migrating to a new production environment. Stolen funds were converted to ETH and partly moved through Tornado Cash; a liquidity-provider recovery plan is pending. Partners including Mandiant, SEAL 911, zeroShadow, Collisionless and Inca Digital are assisting tracing and recovery efforts.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Vaults
• BTC