Ostium Exploiter Sends 10,540 ETH Into Tornado Cash

The wallet that drained Ostium is already laundering the take. PeckShield said Thursday that the attacker who emptied the real-world-asset perpetuals protocol on Arbitrum has pushed 10,540 ETH into Tornado Cash, part of a theft the blockchain security firm now pegs at roughly $24 million in USDC. By PeckShield's read, the laundering was still underway.

The tally climbs

That $24 million sits well above the up-to-$18 million loss reported when the exploit first surfaced. PeckShield called the higher number a product of continued tracing, not a second breach. Ostium's OLP vault, its public liquidity pool, was 'drained of ~$24M $USDC,' the firm wrote. The Defiant reported earlier that Ostium halted trading after an oracle exploit hit the vault.

The attacker did not sit on stablecoins. PeckShield says the stolen USDC was swapped into 12,086 ETH, and 10,540 of that has already reached Tornado Cash. A flow diagram from the firm tracks USDC sums of 26.4 million and 23.4 million into the attacker's deployed wallet before the conversion. A separate explorer table shows the ether leaving in a steady run of 100-ETH deposits, next to a 784.66 ETH transfer in from an address tagged 'Ostium Exploiter 3.' Once ETH enters the mixer, following it on-chain gets much harder.

The funding trail

The setup was cheap. PeckShield traced the origin wallet, 0x321D...8bfD9, to two 1 ETH deposits: one from ChangeNow, a non-custodial swap service, and one from Bybit, a centralized exchange. The Bybit leg is the interesting one. Centralized venues run KYC, and a deposit routed through one can, in principle, tie an address back to a person.

The size of the loss lands hard against what Ostium has left. The protocol still shows $37.80 million in total value locked, all on Arbitrum, according to DefiLlama, so the drained stablecoins were worth most of a platform this size. How much comes back is the open question, and every 100 ETH that clears Tornado Cash pushes the answer lower.