Taha Pathan

I promised to share a bit more context on Ostium’s finances and revenue model yesterday, as I believe much of the discussion on X is grounded in a misunderstanding of how the protocol monetizes, its costs, and a resulting inflated view of the company’s finances. I will cover both revenues and expenses. 1. Revenue The ~$44.7M top-line revenue number on Dune (linked below) reflects the aggregate value flowing over 2 years across four protocol sources: opening fees ($20.39M), price impact/spreads ($16.5M), rollover fees ($4.75M) and liquidation fees ($3.35M). Since 2024, that top-line revenue has flowed: - $22.14M (49.6%) to the OLP vault: 30% of opening fees (after June 16, 2025; 50% of opening fees before that) plus, until the April 28th 2026 liquidity upgrade, all spreads, rollover and liquidation fees. Because OLP was the direct counterparty to traders, those flows didn’t guarantee OLP returns were always net positive: revenue capture on OLP was sometimes enough and other times insufficient to make up for the times when residual trader deltas worked against the pool. - $19.55M (43.8%) in liquidity costs: $16.05M in hedging and $3.49M in interest on hedging capital. - $2.96M (6.6%) retained as gross profits. Top-line revenue is measured onchain, while take-home gross profits are dependent on off-chain hedging costs that definitionally aren’t reflected on a blockchain. Spreads as a category are computed as the difference between mid- and execution price. Off-chain hedges face spread costs too - no trade executes at mid - as reflected in the liquidity costs category. The same is true for rollover fees; any margined position has holding costs. Ostium is a growth business, and our goal was expansion over short-term monetization. Prior to April, Ostium did not have the ability to monetize flow; the April upgrade was the first step in that direction, and the system had been live for a matter of months when the exploit happened. Finally, we will add more detail and clearer nomenclature to the Dune dashboard over the coming days, including splitting the pre- and post-liquidity upgrade revenue for clarity. We will share a post with details when this has been done. 2. Expenses Ostium raised $300k in 2022, $3.6M in 2023, $4.1M in 2024, and $19.4M in 2025. We raised our Series A into a rapidly growing and highly competitive market. After years of waiting for the market to catch up, it finally had. Now our mandate was to grow, fast. Ostium expanded from ~12 team members in 2025 to 35 in Q2 of 2026, driven first by a wave of engineering hires, and later by an expansion of the growth and marketing teams. Beyond salaries, we invested heavily in data licenses and direct-to-consumer marketing, while bearing heavy cloud infrastructure, auditing, and AI costs. We expanded spend aggressively. In a winner-take-all – or most – market, we made the bet most companies at our stage make: invest everything in growth. In hindsight, we did not build a balance sheet that gave us room to respond to an event like this. We struggled to accept that reality and were silent for far longer than we should have been. That was a mistake. 3. The path forward Growing the business and giving the 345 remaining OLP holders a stake in that growth is the most viable path to recovery we see. We will be sharing more details on Stage 2 recovery in the coming week. The plan will center on shared upside. We have received tremendous input from many of you over the last 48H, and will continue to iterate with OLP holders to design a structure that ties outcomes to the protocol’s success, while being compatible with future financing. Thank you to the many of you who have sent supportive messages, both privately and publicly, over the last days. We recognize it will take time to build back confidence. We will continue fighting, and would like all of you to be on that journey with us.

We've been quieter than usual over the past few days, and have been spending that time getting trading back up, continuing the ongoing investigation, and building a detailed recovery plan for LPs. I know the lack of updates has been difficult, especially for LPs waiting for clarity. We do not want to publish a partial plan, and have been focused on finalizing the details. The technical review and migration were led by our engineering and infrastructure teams, who have worked relentlessly since July 15. This effort enabled trading to resume on a completely new stack last Thursday, which I’m incredibly grateful for. This post mortem is just one step. The next big update people are looking for is what recovery and the path forward will look like, and that is where my focus remains. We are thankful for the patience and support of all of our partners and users. More to come.

Status Update: The forensic investigation remains ongoing. We are working closely with law enforcement and leading cybersecurity experts. Our team of experts continues to trace funds and actively coordinate with exchanges, bridges, and stablecoin issuers. The trading contracts were and remain frozen to contain the incident. Public communications will be shared with a minimum of 24 hours notice prior to any unfreezing of smart contracts. At present, positions remain open. When trading resumes, traders will again be able to manage or close them. We will share updates as we are able to responsibly over the coming days, including a technical post-mortem and outline of the path forward towards protocol restoration. Please trust only official channels. We are not circulating recovery forms and will never ask for your keys, seed phrase, or funds. The support we have received over the past 36 hours has been extraordinary. To the partners, friends, security experts, and industry peers who have helped us in this: thank you. More to come.

This morning, between 14:18–14:23 UTC, Ostium experienced a security issue leading to a loss of funds from the public OLP vault. Our team identified the issue within minutes and immediately began taking steps to contain it, including coordinating to pause trading contracts within the hour. We are working closely with relevant law enforcement authorities, SEAL 911, and third-party cybersecurity experts. No founder ever wants to deliver an update like this. We recognize the responsibility that comes with building infrastructure that people choose to use and trust. We take that responsibility seriously, and our focus is on resolution and responding with transparency and accuracy. To the stablecoin issuers, bridges, protocols, and security partners who have moved quickly to assist us: thank you for your continued support. We will continue to provide updates as they arise.