Ostium Vault Exploiter Routes 10,540 ETH to Tornado Cash

The exploiter who drained Ostium, a real-world-asset perpetuals protocol on Arbitrum, has moved 10,540 ETH into Tornado Cash, blockchain security firm PeckShield said in a post on Thursday.

PeckShield reported that Ostium's public OLP vault "has been drained of ~$24M $USDC." The firm said the exploiter swapped the stolen stablecoins for 12.08K ETH and had "deposited 10,540 $ETH to #TornadoCash so far," indicating laundering was still underway.

The $24 million figure is higher than the up-to-$18 million loss reported when the exploit first surfaced. The revised total from PeckShield reflects continued tracing of the drained funds rather than a separate incident.

PeckShield said the exploiter "originally funded Wallet 0x321D...8bfD9 with 1 ETH from #ChangeNow and 1 ETH from #Bybit." ChangeNow is a non-custodial exchange service and Bybit is a centralized exchange.

A diagram accompanying the post traces USDC amounts of 26.4 million and 23.4 million to the attacker's deployed wallet, a swap into 12,086 ETH, and 10,540 ETH sent onward to Tornado Cash. A second image, a blockchain explorer table, shows a series of 100 ETH deposit transactions leaving an intermediary address and an inbound transfer of 784.66 ETH from an address labeled "Ostium Exploiter 3."

Ostium's total value locked stood at $37.80 million, all on Arbitrum, according to DefiLlama datay.

The Defiant previously reported that Ostium halted trading after an oracle exploit drained the vault.