Security firms provided varying loss estimates in the hours after the attack. Blockaid pegged the payout near $18 million, Cyvers estimated $23.7 million, and PeckShield later described roughly $24 million drained. Ostium’s own post-mortem confirmed the final figure at 23,752,746 USDC. Galaxy Research traced eight payments to a single wallet, including transfers of approximately $11.86 million, $4.49 million, and $3.59 million. The stolen USDC was swapped into 12,080 ETH, and 10,540 ETH was subsequently moved to Tornado Cash, a privacy mixer that complicates recovery.
Trader collateral sat in a separate, isolated contract and was not affected. Open positions remained recorded but were frozen when Ostium paused trading within 60 minutes of the first exploit transaction. The team engaged Mandiant, zeroShadow, Collisionless, and SEAL 911 alongside law enforcement, and coordinated with exchanges, bridges, and stablecoin issuers.
Trading resumed on July 23 after an eight-day investigation and hardening effort. At reopen, open positions and pending orders carried over and were marked to the live market price at that moment. A position would be liquidated only if it was below its liquidation level at the reopening price. Take-profit, stop-loss, or limit orders whose levels had been reached at the live prices at 10:00 a.m. ET on July 23 executed then. The protocol enabled actions in stages, starting with protective and reduce-only actions, followed by opening new positions once pending orders cleared.