Ostium, the perpetuals protocol built on Arbitrum, has repaid 3,321 wallets in full following a July exploit that drained $23.7 million from its off-chain liquidity provider vault, while 345 larger affected wallets must now choose among recovery options laid out in a term sheet dated August 29.

The recovery framework divides claimants by scale. Smaller depositors in the off-chain liquidity provider (OLP) vault — where users deposit USDC to serve as counterparty liquidity for traders — are being made whole outright. Larger liquidity providers face a negotiated path back to their capital, the terms of which Ostium laid out in the term sheet distributed last Friday.

The exploit itself stands out among this year's DeFi incidents for what it did not involve. On July 15, the attacker did not crack a smart contract or compromise a multisig. Instead, the intruder infiltrated Ostium's off-chain infrastructure and submitted fraudulent BTC-USD price reports, effectively tricking the protocol into releasing funds against falsified market data. Eight bogus transactions later, 23,752,746 USDC had left the vault.

The damage was confined to the OLP vault. Trader collateral was never at risk, which allowed Ostium to resume trading operations on July 23 — eight days after the breach — following a migration to what the team described as a more secure environment.

Ostium Labs has committed to contributing from its own balance sheet to cover losses for affected liquidity providers, according to the protocol's recovery announcements. The company initiated a forensic investigation after the incident alongside specialized firms including Mandiant and zeroShadow. That investigation confirmed the vulnerabilities sat not in on-chain code but in off-chain processes, including the infrastructure responsible for feeding price information to the protocol.

The case adds to a growing body of evidence that oracle and price-feed infrastructure remains a primary attack surface for derivatives protocols, even where smart contracts themselves are sound. For Ostium, the operational consequence is a two-track recovery: restoring depositor confidence in the OLP vault while hardening the off-chain layer that traders depend on for accurate settlement prices.

A parallel legal battle complicates the picture. The Ostium Foundation is in litigation over a $15 million USDC loan default — an entirely separate matter that nonetheless places additional strain on the entity's financial resources at a moment when balance-sheet contributions are funding the recovery. The combination of an exploit reimbursement and a loan dispute means the foundation's obligations run well beyond the vault losses themselves.

For the 345 wallets still awaiting resolution, the term sheet marks the decision point. Accepting its terms would close out the recovery process; rejecting them could prolong litigation and delay distributions. Either way, the outcome of those negotiations, alongside the foundation's court fight over the defaulted loan, will determine how quickly Ostium can put the July incident fully behind it.