The exploiter behind the attack on Ostium, a real-world-asset perpetuals protocol on Arbitrum, has moved 10,540 ETH into Tornado Cash, according to blockchain security firm PeckShield. The firm said Ostium’s public OLP vault was drained of about $24 million in USDC, with the stolen stablecoins later swapped for 12,086 ETH. PeckShield noted that the revised $24 million figure is higher than the up-to-$18 million loss cited when the exploit first emerged, but said the difference reflects continued tracing of the drained funds rather than a separate breach. The security firm also said the attacker originally funded wallet 0x321D...8bfD9 with 1 ETH from ChangeNow and 1 ETH from Bybit. A diagram shared with the post mapped USDC flows of 26.4 million and 23.4 million into the attacker’s deployed wallet, the swap into ETH, and the onward transfers into Tornado Cash. Separate blockchain explorer data showed repeated 100 ETH deposits from an intermediary address, along with an inbound transfer of 784.66 ETH from an address labeled “Ostium Exploiter 3.” DefiLlama data puts Ostium’s total value locked at $37.80 million, all on Arbitrum. The Defiant had earlier reported that Ostium halted trading after an oracle exploit drained the vault.
The exploiter behind the attack on Ostium has moved 10,540 ETH into Tornado Cash, according to a Thursday post from blockchain security firm PeckShield. Ostium is a real-world-asset perpetuals protocol on Arbitrum.
PeckShield said Ostium’s public OLP vault “has been drained of ~$24M $USDC.” The firm added that the attacker swapped the stolen stablecoins for 12,086 ETH and had “deposited 10,540 $ETH to #TornadoCash so far,” a sign that the laundering process was still in progress at the time of the post.
Updated loss figure exceeds the initial estimate
The $24 million figure is above the up-to-$18 million loss cited when the exploit first came to light. PeckShield said the revised total reflected ongoing tracing of the drained funds, not a separate incident.
Funding trail and transaction details
PeckShield also said the exploiter “originally funded Wallet 0x321D...8bfD9 with 1 ETH from #ChangeNow and 1 ETH from #Bybit.” ChangeNow is a non-custodial exchange service, while Bybit is a centralized exchange.
A diagram shared alongside the post traced USDC amounts of 26.4 million and 23.4 million to the attacker’s deployed wallet, followed by a swap into 12,086 ETH and the onward movement of 10,540 ETH to Tornado Cash.
A second image, described as a blockchain explorer table, showed a string of 100 ETH deposit transactions leaving an intermediary address. It also showed an inbound transfer of 784.66 ETH from an address labeled “Ostium Exploiter 3.”
TVL and prior response
According to DefiLlama data, Ostium’s total value locked stood at $37.80 million, with all of it on Arbitrum.
The Defiant had previously reported that Ostium halted trading after an oracle exploit drained the vault.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
