Rotten

Ostium

PerpsVault incident

Perpetuals protocol on Arbitrum for stocks, indices, commodities, FX and crypto, settled in USDC.

Security record: 1 incident · 1 own fault · 1 not or partly repaid
Go to Ostium

What it is

  • 75 perp pairs across stocks, ETFs, commodities, indices, forex and crypto, settled on Arbitrum
  • Leverage from 5x to 200x by pair; stocks up to 100x
  • Opening fees from 3 to 10 bps by pair; trades settle in USDC
  • Self-custody: USDC stays in your wallet until a trade locks margin
  • A USDC vault settles trades while flow is hedged off-chain with institutional partners

MeLong score

No score yet

We score a venue only when its rewards, taker fee and volume are confirmed. How we score

Taker
0.03%
Volume a day
$4M
Open interest
$8M
Taker fee 6.1
No taker fee is a 10, 0.07% or more is a 1. A venue that earns from the spread tops out at 7.
Volume 1.0
Average a day: $5M is a 1, $5B is a 10, on a log scale. Volume past ten times open interest does not count.
Safety 2.0
Jul 2026 vault exploit took 23.75M USDC; repayment still in progress
Open interest 3.7
$1M is a 1, $1B is a 10, on a log scale. Harder to farm than volume.
Ease 10.0
Gasless one-click with email login, stocks, FX and crypto in one app
Access 6.0
No KYC, but closed to US, UK, the whole EU and the Philippines
Compare all perp DEXs

How to start

Cost to start: Minimum collateral per trade typically 10 to 100 USDC, by pair

  1. Open app.ostium.com and click Connect (email or Web3 wallet)
  2. Get USDC on Arbitrum, or use Fund Account to convert from another chain
  3. Pick a pair, direction, leverage and collateral
  4. Open the trade and set take-profit and stop-loss

Live campaigns

Risks to know

Stocks follow exchange hours, and day-trading positions above the overnight leverage cap auto-close at 3:45 PM ET. Rollover fees apply while you hold, and positions can be liquidated. The vault takes the other side of trades.

Security record

1 incident · 1 own fault · 1 not or partly repaid

Past incidents 1

Oracle signer key stolen, OLP vault drained. An attacker who held an Ostium oracle signer private key pushed fake future-dated price reports through an authorized forwarder and opened fake winning trades, draining the OLP liquidity vault. Ostium halted trading, rebuilt its price stack and resumed on 23 July. Phase 1 fully covers 3,321 of 3,666 affected wallets (losses up to 1,000 USDC paid in USDC); larger losses go to a Phase 2 plan of USDC instalments or Ostium Labs equity, with 649,967 USDC recovered so far.

Own faultUsers lost 23,752,746 USDCPartly repaid

Sources: x.com, decrypt.co, halborn.com

From the project’s statements and security coverage. Own fault means the project’s code, servers or keys; third party means a vendor, registrar, oracle or issuer it relies on.

More in Perps

Sources 20

Facts from the official sources above.

Go to Ostium