TheBlock
Ostium blamed its $23.75 million exploit on a compromise of off-chain infrastructure in a July 15 post-mortem, explicitly ruling out a smart-contract vulnerability. The team said trader collateral was untouched and promised a separate recovery plan for affected liquidity providers.
Why it matters
A clean contract audit means nothing if the servers, oracles, or signing keys around it get popped. Off-chain breaches have become the dominant failure mode across DeFi in 2025, and they shift the security question from open-source code review to operational discipline: key management, employee access, vendor trust, and incident response. For LP recovery, that also shifts the locus of accountability, since on-chain treasuries can't unilaterally claw back attacker-controlled funds.
Market impact
The protocol preserved its core contracts, which leaves open the door for a redeploy. But an LP recovery plan is the next catalyst: watch for the funding source (treasury, token issuance, or external negotiation), the haircut applied to LPs, and whether $24M is fully covered or partially absorbed. Governance-token holders get a vote on whichever path the team proposes.
Frequently asked questions
-
How much was stolen in the Ostium exploit?
Ostium pegged the loss at $23.75 million in its July 15 post-mortem, stemming from an off-chain infrastructure compromise.
-
Was the Ostium smart contract hacked?
No. The team's post-mortem explicitly ruled out a smart-contract vulnerability and attributed the breach to off-chain infrastructure.
-
Was trader collateral affected by the exploit?
Ostium said trader collateral was untouched. The loss sits with liquidity providers, for whom a separate recovery plan is promised.
-
When did the Ostium exploit happen?
The exploit occurred on July 15, with the post-mortem and attribution to an off-chain breach published afterward.
-
What is the recovery plan for affected Ostium liquidity providers?
Ostium said it will release a separate recovery plan for affected LPs. Funding source, haircut, and governance vote have not yet been disclosed.
CoinDesk
CryptoSlate
Lookonchain
Crypto News