reported loss from the OLP vault
Rekt incident reconstruction, July 21, 2026Ostium: Price Feed Compromise
Ostium accepted a Bitcoin price of $5,000, then roughly $60,000 inside the same transaction. The film follows the artificial profits, the vault payouts and the reported exit into ETH.
- Date
- July 15, 2026
- Network
- Arbitrum
- Reported amount
- $23.75Mreported loss from the OLP vault
- What happened
- Accepted price reports turned into artificial trading profits
- Status
- Infrastructure compromise reported; attacker identity not established
- This file rests on
- 0 recorded and 12 reported statementsacross 10 linked identifiers
12 chapters · choose one to jump the film to it
Replay it yourself.
These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.
A five-minute drain
A perpetuals exchange lets users trade price movements without holding the underlying asset. Here, the losses came from the pool backing those trades.
Reported by othersOpens a live lookup on the Summary view. Today’s capture may differ from the film’s.- About $23.75 million was taken during a reported five-minute, twenty-nine-second sequence.Rekt incident reconstruction, July 21, 2026
The price was the input
An oracle supplies outside prices to a blockchain. The accepted Bitcoin prices in this sequence jump from $5,000 to roughly $60,000 within one transaction. That is an input to the trades, not a real market move.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The incident reconstruction identifies artificial opening and closing prices accepted by the protocol.Rekt incident reconstruction, July 21, 2026
Start with the small test
Read the first small trade cycle before the large payout. Distinguish the deposited collateral, vault payout and returned margin rather than treating every transfer as profit.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The film reconstructs a $100 test cycle before the larger batch.Supplied Forensia case-study film; no independent retained capture attached
Five cycles in one batch
A batch transaction groups several actions together. The film follows repeated position opens, price deliveries and closes in the main transaction.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The main transaction is executeBatch; Arbiscan lists it as successful at 14:18:48 UTC.Arbiscan, main batch transaction
- The film follows five open-close cycles in this batch.Supplied Forensia case-study film; no independent retained capture attached
Follow the price-delivery path
The reconstruction identifies PrivatePriceUpKeep as the price-delivery contract in this path. Public PriceUpKeep is a separate deployment.
Reported by othersOpens a live lookup on the Analysis view. Today’s capture may differ from the film’s.- The named price-delivery deployment is 0xB71e…3d36.Rekt incident reconstruction, July 21, 2026
A signature is not a price check
A signature check can identify an authorized signer. It does not independently establish that the submitted Bitcoin price was economically reasonable.
Reported by othersOpens a live lookup on the Analysis view. Today’s capture may differ from the film’s.- The analysis follows the verifier and its approved-signer check; the exact initial compromise remains unconfirmed.Rekt incident reconstruction, July 21, 2026
Keep the accounting straight
Compare the small test, the main batch and the later drains. Gross vault transfers, returned collateral and net losses describe different quantities.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The film reconstructs a net vault loss of $23,752,746.55 across the sequence. This total is reported here, not independently reproduced.Supplied Forensia case-study film; no independent retained capture attached
From USDC into ETH
The reported trail moves from vault payouts to swaps, then multiple addresses and mixer deposits. Each boundary needs its own transaction evidence.
Reported by othersOpens a live lookup on the Graph view. Today’s capture may differ from the film’s.- The reporting describes conversion into 12,084 ETH and 10,540 ETH deposited into Tornado Cash.Rekt incident reconstruction, July 21, 2026
The trusted-keeper boundary
A keeper is an automated actor that triggers protocol actions. Read which actions it was trusted to perform and what the bounty scope excluded.
Reported by othersOpens a live lookup on the Analysis view. Today’s capture may differ from the film’s.- The cited bounty scope treats registered keepers and their forwarders as trusted and excludes attacks requiring a malicious or compromised keeper.Immunefi, Ostium bounty scope cited in the incident reconstruction
A warning and its scope
The film contrasts prior contract reviews with the price-reporting infrastructure. Audit findings and scope statements should be checked in the original reports.
Reported by others- The incident article points to an earlier auditor warning about compromised forwarders.Rekt incident reconstruction, July 21, 2026
What Ostium reported
Separate the team's account of containment from the transaction record. A dated response is not a current recovery guarantee.
Reported by others- Ostium reported compromised off-chain price infrastructure and frozen trading; the July 18 update is linked through the incident article.Rekt incident reconstruction, July 21, 2026
Investigate the records
Open the batch, vault or payout recipient in Forensia. Read available calls, token movements and source records, preserving any missing coverage. A live lookup is a starting point for review.
Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.
What the headline said. What a closer reading shows.
accepted BTC prices inside the same transaction, not a market rally
Supplied film and linked transaction analysisThe incident on one map
Who called what, and where it went.
Recorded in the workspaceReported by others
In the order it happened.
The film places the initial small test here.Reported by others
The main batch is confirmed in Arbitrum block 484,137,113.Reported by others
The reported final drain completes the eight-transaction sequence.Reported by others
Reporting follows swaps into ETH and deposits into Tornado Cash.Reported by others
Ostium reports an off-chain price-infrastructure compromise.Reported by others
Rekt publishes the linked incident reconstruction.Reported by others
The cast
Open the investigation ↗Every address and transaction in this case.
Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.
What was taken from
The wallet, bridge or addresses the value left.
- The OLP vaultArbitrum contract
The liquidity-provider vault that funded the reported artificial trading profits.
Where it went
Addresses that received the value. Who controls them is not established here.
- Reported payout recipientArbitrum address
Arbiscan labels this address Ostium Exploiter 1. It receives the main batch payouts; a label is not proof of a person's identity.
- Sender of the main batchArbitrum address
Arbiscan lists this address as the transaction sender and labels it Ostium Exploiter 2. Keep its role distinct from the payout recipient.
Code involved
Contracts that were called or run along the way.
- PrivatePriceUpKeepArbitrum contract
The specific price-delivery deployment linked in the incident reconstruction, distinct from public PriceUpKeep.
- Verifier used in the reconstructionArbitrum contract
The verifier identified by the reported Registry update and execution path. Historical observations matter more than a current name tag.
- Ostium TradingArbitrum contract
Opens and closes positions and requests a price.
- TradingCallbacksArbitrum contract
Settles trades against the delivered price and requests vault payouts.
The transactions
The individual records each step of the case rests on.
- The main batch transactionArbitrum transaction
Start here: the successful executeBatch transaction at 14:18:48 UTC, block 484,137,113.
- The test transactionArbitrum transaction
The initial small trade cycle used to test the path before the larger batch.
- The last reported drainArbitrum transaction
The final transaction in the reported eight-transaction sequence.
Two kinds of statement, kept apart.
This file combines the supplied film, linked explorer records and named incident reports. No independently retained Forensia capture is attached. Investigation links run fresh Arbitrum lookups; their coverage and results may differ from the film. The reports do not establish exactly how price-reporting access was obtained or who controlled the addresses. A mixer deposit does not establish a matching withdrawal.
What the chain records0
No independently retained chain capture is attached to this case. Linked records and source reports are available above; workspace coverage is stated for this case.
What others have reported12
- Step 1
About $23.75 million was taken during a reported five-minute, twenty-nine-second sequence.Rekt incident reconstruction, July 21, 2026
- Step 2
The incident reconstruction identifies artificial opening and closing prices accepted by the protocol.Rekt incident reconstruction, July 21, 2026
- Step 3
The film reconstructs a $100 test cycle before the larger batch.Supplied Forensia case-study film; no independent retained capture attached
- Step 4
The main transaction is executeBatch; Arbiscan lists it as successful at 14:18:48 UTC.Arbiscan, main batch transaction
- Step 4
The film follows five open-close cycles in this batch.Supplied Forensia case-study film; no independent retained capture attached
- Step 5
The named price-delivery deployment is 0xB71e…3d36.Rekt incident reconstruction, July 21, 2026
- Step 6
The analysis follows the verifier and its approved-signer check; the exact initial compromise remains unconfirmed.Rekt incident reconstruction, July 21, 2026
- Step 7
The film reconstructs a net vault loss of $23,752,746.55 across the sequence. This total is reported here, not independently reproduced.Supplied Forensia case-study film; no independent retained capture attached
- Step 8
The reporting describes conversion into 12,084 ETH and 10,540 ETH deposited into Tornado Cash.Rekt incident reconstruction, July 21, 2026
- Step 9
The cited bounty scope treats registered keepers and their forwarders as trusted and excludes attacks requiring a malicious or compromised keeper.Immunefi, Ostium bounty scope cited in the incident reconstruction
- Step 10
The incident article points to an earlier auditor warning about compromised forwarders.Rekt incident reconstruction, July 21, 2026
- Step 11
Ostium reported compromised off-chain price infrastructure and frozen trading; the July 18 update is linked through the incident article.Rekt incident reconstruction, July 21, 2026
Reports behind this case.
- Rekt: Ostium incident reconstruction, July 21, 2026 ↗
- Arbiscan: main executeBatch transaction, July 15, 2026 ↗
- Arbiscan: initial test transaction ↗
- Arbiscan: final reported drain transaction ↗
- Ostium documentation: automation and keeper roles ↗
- Immunefi: Ostium bug bounty scope (current page may change) ↗
Share and cite
Take the case with you.
The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.