Ostium: What the Onchain RWA Perpetuals Platform Is, How It Works and the 2026 Exploit

The Terms of Use describe two separate entities ⁴:

• Ostium Labs Co. built the software.
• Ostium Foundation provides some of the services.

Both say they do not run an exchange, execute trades or take custody of user funds. The protocol is described as open-source smart contracts on Arbitrum, and the website, web app, Telegram bot and mobile app are interfaces to it ⁴.

Ostium raised $3.5 million in 2023 in a round led by General Catalyst and LocalGlobe ². It reports more than $27 million raised in total, including a $20 million Series A co-led by General Catalyst and Jump Crypto. Participants include Coinbase, Wintermute Ventures, GSR, Susquehanna and Alliance DAO ¹. In May 2026 it announced a partnership to use Nasdaq market data for equity perpetuals ⁵. Founders' names do not appear in the official documentation we reviewed.

Ostium lists perpetual contracts across six asset classes ¹:

• equities such as NVDA;
• indices such as the US100;
• commodities including gold, silver, copper and crude oil;
• currency pairs such as USD/JPY;
• ETFs;
• crypto such as BTC.

Positions start from $5 of collateral ¹. In April 2025, crypto was the largest share of daily volume, followed by forex, commodities and indices ².

Non-crypto markets follow their real-world trading hours. When a stock or forex market is closed, market orders are not accepted. You can still place limit and stop orders, which execute after the reopen if the price conditions are met ¹¹. Prices can gap at the open, so a stop may fill well away from its trigger.

Ostium is pool-based rather than an order book ². The flow works like this ¹⁰¹¹:

1. Connect a wallet and post USDC. You connect a self-custody wallet on Arbitrum and post USDC as collateral. The collateral sits in the protocol's trading contract while the position is open.
2. Choose the order. You pick long or short, an order type (market, limit or stop) and leverage. The docs give a range of 1x to 200x, with lower caps on more volatile or less liquid assets such as copper.
3. Price request. When you submit an order, the contract requests a price.
   • Crypto prices come from Chainlink Data Streams.
   • Real-world asset prices come from Ostium's in-house pull oracle, whose nodes are mostly run by Stork.
   • Automation services execute pending orders, liquidations, stop losses and take profits.
4. Fill against the vault. Your counterparty is effectively the Ostium Liquidity Pool (OLP). Profits are paid from it and losses flow into it ¹⁶.

Two design details matter:

• Mandatory take-profit. Every trade has an automatic take-profit at a 900% gain. The docs present this as a cap that protects liquidity providers from tail events ¹⁰.
• Real market prices. Execution uses the underlying market's bid and ask, or a "dynamic spread" on some pairs. Longs open at the ask and close at the bid ⁹¹⁰. See slippage and order types for background.

Ostium charges an opening fee and a rollover fee, plus a small oracle fee. It has no closing fee ⁹. According to the (now deprecated) fee documentation ⁹:

Illustration (assumptions stated, not a quote):

• Position: $10,000 of notional exposure on a pair with a 4 bps opening fee.
• Opening fee: $4.
• Oracle fees: $0.10 on the open, plus $0.10 on the close that is refunded if the close succeeds.
• Rollover: comes on top and depends on the asset, side and holding time.

Check the live pair page before trading, because fee parameters are set per market.

Liquidity providers deposit USDC into the OLP vault and receive OLP tokens for their share. The vault backs all open positions ¹⁶. LPs earn from fees and trading activity, and they absorb trader profits ².

Before the July 2026 incident, withdrawals followed a fixed schedule ¹²:

1. Submit a withdrawal request.
2. The request is processed at the settlement after the next one, 24–48 hours later.
3. Click Redeem to receive the USDC.

As of late September 2026, new OLP deposits are disabled and withdrawals process on a T+3 schedule ⁸.

The incident showed the main risk of pool-based perps. If prices fed to the protocol are wrong, the vault pays out real USDC against fake profits.

Ostium is non-custodial. Users keep their keys, and the companies say they cannot access user wallets ⁴.

The protocol still relies on several trusted components:

• authorized price signers;
• registered "forwarder" contracts that deliver prices;
• automation services;
• governance or timelock control over who may sign ⁶¹¹.

Galaxy Research notes that Ostium's oracle checks who signed a price, not whether the price is correct ⁶.

Ostium publishes audit reports from Zellic (two, the later in November 2025), Three Sigma and Pashov, along with its contract addresses ¹³. DefiLlama lists two audits ³. An audit reviews code at a point in time and is not insurance. The July 2026 loss did not stem from contract logic ⁵.

Both give leveraged, synthetic price exposure without delivering the underlying asset. The differences are in custody, regulation and who stands behind the trade:

• Custody and counterparty. With Ostium, collateral stays in smart contracts you interact with from your own wallet, and the counterparty is a USDC liquidity pool. A CFD broker holds client money and is usually a licensed entity ¹⁴.
• Investor protection. The Ostium entities say they do not operate an exchange ⁴. That means no broker-style investor-compensation scheme or regulator complaint route applies.
• Failure modes. Smart-contract, oracle and vault-solvency risk replace broker counterparty risk.

For the broader trade-off, see CEX vs DEX. Other on-chain perps venues include Hyperliquid and GMX.