Ostium attacker moves 10,540 ETH to mixer after $24M USDC drain from public fund

The wallet tied to the Ostium exploit has moved 10,540 ETH into Tornado Cash, according to blockchain security firm PeckShield. The transfer comes after Ostium’s public OLP vault on Arbitrum was drained of about $24 million in USDC, PeckShield said.

Ostium is a real-world-asset perpetuals protocol, and the drain hit its public vault rather than a private user account. That detail matters because public vaults are designed to hold shared liquidity for the protocol, making the attack a direct hit to the system’s onchain reserves.

PeckShield said the exploiter routed the ether through Tornado Cash, a crypto mixer that obscures transaction trails by pooling deposits and withdrawals. Once funds move there, tracing them becomes harder, although blockchain analysts can still follow the sequence up to the mixer and watch for later exits.

The size of the transfer stands out. At current prices, 10,540 ETH is worth tens of millions of dollars, putting the ether movement in line with the scale of the USDC drain reported by PeckShield. The move also suggests the attacker is trying to separate the proceeds from the original theft before any recovery effort gains traction.

Arbitrum, the Ethereum layer-2 network where Ostium operates, has been the scene of several DeFi incidents this year as attackers continue to target protocol treasuries, vaults and liquidity pools. For users and investors, the immediate question is whether Ostium can contain the damage, account for the missing funds and restore confidence in its vault structure.

The next items to watch are a formal postmortem from Ostium, any recovery or bounty effort, and fresh wallet activity from the exploiter. If more of the stolen assets are bridged or mixed, tracking the funds will get harder.