Bybit
21 Feb 2025 · USD 1.4 to 1.5 bn
A delegatecall to a foreign contract, hidden behind a manipulated signing interface.
A rule “no delegatecall outside an allowlist” is enough. Operators read the raw transaction, not the interface.
SourceTestnet MVP
A doorkeeper for your wallet, who answers for every door he opens.
Every withdrawal from a protected wallet needs the network's co-signature, and the network checks it against your public house rules first. An operator who co-signs a forbidden withdrawal loses their stake to the victim.
Bitcoin signet, Ethereum Sepolia and Arbitrum Sepolia. Unaudited code, test funds only.
Withdrawal request
example0.40 ETH
to 0x9f3c…a21e · Arbitrum Sepolia
Operator 1 refused
Operator 2 refused
Operator 3 refused
Rule 2, daily limit
With this transfer today's total would be 0.55 ETH, above the daily limit of 0.50 ETH.
Both decoders agreed. Every refusal is signed and logged.
The idea
The approval is the weak point. So the approver should be liable.
The largest losses of 2025 and 2026 did not come from programming bugs. They came from signatures that were formally valid: compromised signing systems, spoofed interfaces, pre-signed transactions. Each time the code did exactly what the signature asked for, and nobody but the victim was liable.
The doorkeeper
The name comes from the Latin ostiarius, the doorkeeper. He opens the door only to those who may enter, and he answers for it.
Rules anyone can check
House rules are deterministic and public by hash. A third party can prove a violation from the transaction and the policy alone, without trusting any operator.
Works where wallets cannot
Rules inside a smart wallet only work on programmable wallets. Ostiary co-signs, so it also covers Bitcoin and plain accounts. Where a wallet contract can enforce the rules itself, you do not need us, and we say so.
How it works
Five steps, each one leaves evidence.
At the end it is possible to say exactly who approved what. Below each step: what this testnet build actually does today.
- 01
A shared key
Your wallet needs two parties to sign: you and the Ostiary network. Neither side can move funds alone. On chain it looks like an ordinary wallet.
Testnet: your key plus 2 of 3 operator keys (an EVM vault contract or a Bitcoin P2WSH script). Threshold MPC comes in phase 1.
- 02
House rules
You write a policy: daily limits, a recipient allowlist, no delegatecall, no EIP-7702 delegation, no change of admin rights. Its hash is public, and any change only takes effect after a delay.
Testnet: the hash lives in your vault contract on EVM; changes wait 2 days.
- 03
Independent checks
Every operator decodes the raw transaction itself with two decoders written independently, in two languages. If they disagree, nobody signs. No interface is trusted.
Testnet: decoder A in Rust, decoder B in TypeScript.
- 04
Personal attestation
An operator who approves signs a statement with their own key: this transaction, checked against this policy, is allowed. Only then do they co-sign.
Testnet: every verdict, allowed or refused, is signed and shown in your vault's log.
- 05
Liability
If a transaction that breaks your rules ever appears, the attestations prove who approved it. Their stake goes to you.
Testnet: staking and slashing exist only as test contracts. Nothing is insured yet.
Incident replays
Would Ostiary have stopped it?
Four recent incidents, judged by one question: would a deterministic house rule, enforced by a liable co-signer, have been enough? Figures are approximate and come from the cited sources as of 30 October 2026.
Yes
Drift
1 Apr 2026 · USD 285 m
Pre-signed multisig approvals (durable nonces) that handed admin rights to the attacker. The timelock had been removed five days earlier.
Ostiary signs only at execution time, never signs durable-nonce transactions for privileged accounts, and house rules cannot change faster than the actions they protect.
SourceKelpDAO
18 Apr 2026 · USD 292 m
Nothing was signed by the victim. A single bridge verifier was fooled through poisoned RPC nodes.
A second independent verifier on separate data sources would have helped, and a rate limit would have capped the damage. It is not a pure signing problem.
SourceBinance
29 Oct 2026 · USD 2.8 to 5.8 bn, preliminary
Reported as an EIP-7702 delegation of a hot wallet to a sweeper, signed with the real key. Binance has not confirmed cause or size.
If the reports hold, a ban on 7702 delegations plus an outflow limit would probably have stopped the Ethereum part. No stake network could cover a loss this size.
SourceThe Binance case serves as an illustration, not as evidence: the figures are from analysts on the day after, and the root cause is not officially confirmed.
For exchanges and custodians
Built to sit in front of a withdrawal engine.
Normal traffic should flow through without anyone noticing. Only transactions that break a rule stop.
Drop-in for your withdrawal engine
Bitcoin: PSBT in, PSBT with operator signatures out, also as a walletprocesspsbt JSON-RPC shim. EVM: the intended transaction in, operator signatures and the encoded execute call out. Batches, fee bumps and sweeps to your own addresses are handled. On EVM it is one changed step, not zero, because the vault is a contract.
Shadow mode
Turn it on without risk: in shadow mode the operators sign every valid request and record what your rules would have blocked, with the rule and the reason. Switch to enforce when the numbers look right. Going back to shadow waits out the policy delay.
Proof of outflow
Every verdict is a leaf in an append-only Merkle log. Download a bundle for any withdrawal and recompute it in your browser or offline. EVM vaults flag any on-chain outflow without a receipt. We know of no publicly documented service that offers this for co-signed withdrawals; that is our reading, not a verified claim.
Honest limits
What Ostiary does not do.
Rule-compliant attacks go through.
A withdrawal to an allowed address within the limit is signed, even if it is malicious. Good rules matter.
Token and chain bugs are not covered.
Ostiary protects wallets, not a token's code and not a chain's consensus.
Coverage is capped.
No stake network can cover a loss the size of Binance's. The model fits hot wallets up to the tens of millions.
The testnet is centralised.
All three operators run on one server today, and the slasher of the test registry is an admin address. Phase 1 moves operators to independent nodes.
Nothing is audited yet.
Every component that moves money gets an external audit before mainnet. Until then: test funds only.
A stolen owner key can start recovery.
After 30 days the owner key alone can recover an EVM vault, but only to the cold recovery address you chose. Ostiary shows a running recovery prominently, and you or the operators can cancel it or freeze the vault.
Tokenomics
OSTR is the gatekeepers' bond.
Exactly 1,000,000,000 OSTR, fixed, with no later inflation. Customers pay premiums in stablecoins; operators earn from them and are liable with their OSTR. The token launches in phase 3 at the earliest. On testnet it exists only as a test contract with no value.
| Pool | Share | OSTR | Release |
|---|---|---|---|
| Operator incentivesover 8 years, decreasing | 30 % | 300,000,000 | over 8 years, decreasing |
| Founders and team1-year cliff, then 3 years linear | 18 % | 180,000,000 | 1-year cliff, then 3 years linear |
| Treasury and ecosystemby governance decision | 15 % | 150,000,000 | by governance decision |
| Investors1-year cliff, then 2 years linear | 15 % | 150,000,000 | 1-year cliff, then 2 years linear |
| Liability reservelocked, claims only | 10 % | 100,000,000 | locked, claims only |
| Early customers and communityby usage | 7 % | 70,000,000 | by usage |
| Liquidityat launch | 5 % | 50,000,000 | at launch |
Where premiums go
- 70 % to operators, in stablecoins. Real yield from real revenue, not newly minted tokens.
- 20 % to the protocol, used to buy back OSTR on the market and burn it.
- 10 % to the reserve, the second layer of coverage.
Slashed OSTR is auctioned and the victim receives stablecoins. Premium rates and haircuts are starting assumptions, to be calibrated with the first customers.
Roadmap
Each phase starts only once the gate before it is met.
If a gate is not met, the next phase does not start; the concept is adjusted or ended instead.
- Phase 0
Validation
months 0 to 2We are here, with this testnet buildReplay hacks, ten customer conversations, sell first policy audits.
Gate: At least three customers want to pay.
- Phase 1
MVP on testnet
months 2 to 6MPC signer for EVM and Bitcoin, decoders A and B, seven own nodes at three providers.
Gate: External audit passed, eight weeks of testnet without a misapproval.
- Phase 2
Guard without liability
months 4 to 10Paying pilot customers on mainnet, Tron and Solana.
Gate: Ten paying wallets, six months without an incident.
- Phase 3
Liability and token
months 10 to 18Settlement contracts, stake, slashing, reserve, OSTR launch, first external operators, Substrate chains.
Gate: Over USD 50 m covered, external operators hold the majority.
- Phase 4
Open network
months from 18ZK violation proofs, reinsurance capital, founding team without a blocking minority.
Live on testnet
The three operators.
These are the public identities of the testnet operators. Each one runs both decoders and the policy engine on its own and signs only when all checks pass. Today all three run on one server; phase 1 moves them apart.
Put a doorkeeper in front of a test wallet.
Create a vault, write house rules, and try to break them. Every refusal tells you which rule fired and why.