Ostium Hack: $24M Oracle Exploit, Fund Movements, and AML Crypto Analysis

After withdrawing the funds, the attacker began transferring assets from Arbitrum—the network on which the exploit occurred—to Ethereum. Some of the transactions used a route associated with MetaMask Bridge.

The move to Ethereum was likely necessary to facilitate further asset swaps and transfers to Tornado Cash. Ethereum’s deeper liquidity makes it easier to convert large amounts and subsequently obscure the transaction trail.

On-chain data confirms that the relevant bridge route was used. However, this alone does not prove that the attacker interacted directly with the MetaMask web interface. The transactions could have been created through the interface, via a third-party aggregator, or programmatically.

If the official MetaMask Bridge interface was used, the service operator may retain technical data such as access timestamps, IP addresses, browser parameters, session identifiers, and other access logs, subject to the applicable data-retention policy.

MetaMask and the bridge providers involved are potential sources of off-chain information that could help link the on-chain addresses to a specific user session.

Необходимо как можно быстрее направить запрос на сохранение данных — preservation request. В запрос следует включить адреса, хеши транзакций и точные временные интервалы в UTC.

Related addresses:
0x3147a355D55755a30e0f2b86b15429ba1f5E191f
0x541444685D56E37E2f6fbF95954910840f73f437
0x647cb46a7aD236c259b6B81673F0cD50a5dC302a
0x6d4095b62ef79CfeB6CaA28ac793659EE2aE94cB
0xEa50Bacf90373ACb58f3e81A39576bAdd7FeB051
0x13637946BB242C9532A310a40c2C1C7B9F2A7E95
0xacE0536f2B00514b17b437110cbbe587F4b965F6
0x6A755a2779E4e372909ccE7fDf0f7E765856af9a
0x7646d24C3E17643DE75D276ed53Be36B88BDe7A6
0xBf85676D35918cF2b793061958df81A5973538fe
0x23A474365c47ad782a31477B2D77739d0ea27DbB

At the time of the analysis, three addresses had been identified where the funds remained stationary, with no subsequent movement:

0x5209536357034c39E172161501761681aE170873
0x43e62b876FB511E7Fc6654aEDD4b9c292D5Ccf60
0xE494eEd9200385A39DC4038438171051984f518f

These addresses may be serving as temporary holding wallets before the next stage of the laundering process. However, their purpose has not yet been established. They could be:

• ordinary self-custodial wallets controlled by the attacker;
• accumulation addresses used before funds are sent to a mixer;
• deposit addresses belonging to an exchange or swap service;
• intermediary bridge addresses;
• addresses controlled by an over-the-counter intermediary.

The absence of outgoing transactions creates a temporary window during which investigators may be able to determine who controls the addresses and notify the relevant service in advance.

These three addresses should be treated as priority monitoring points because the funds have not yet moved and the likelihood of an effective operational response remains relatively high.

Continuous, 24/7 alerts should be configured for all outgoing transactions, including token transfers, approvals, interactions with bridges, and calls to unidentified contracts. At the same time, investigators should review gas-funding history, first-hop counterparties, and any potential links to addresses associated with known exchanges.

If any of the addresses is identified as a deposit address belonging to a centralized service, the service should immediately be provided with an indicators package containing the relevant addresses, transaction hashes, source-of-funds information, timestamps, and the grounds for freezing the assets or preserving associated data.

A significant portion of the funds was distributed across Tornado Cash pools with fixed denominations.

The attacker made no deposits into the 0.1 ETH pool. Most of the funds were directed to the 100 ETH pool.

The use of larger denominations is consistent with the objective of rapidly concealing a substantial volume of funds. Using the 100 ETH pool reduces both the number of required transactions and the associated operational costs.

Once funds enter Tornado Cash, directly matching a specific deposit to a specific withdrawal becomes significantly more difficult. The analysis should consider not only transaction amounts and timing, but also:

• the source of funds used to pay gas fees;
• the relayer operators used;
• the time elapsed between deposits and potential withdrawals;
• the reuse of recipient addresses;
• subsequent transfers to exchanges, bridges, and swap services;
• similarities in behavior across different addresses.

The large number of deposits provides a substantial dataset for correlation analysis. However, the reliability of the findings will depend on the emergence of subsequent withdrawals. A longer observation period may reveal more overlaps and behavioral patterns, although simple temporal correlation may become less reliable over time.