- An attacker exploited a forwarding bug in the Nomic bridge to double-spend nBTC, minting 39.84 nBTC that weren’t backed by real bitcoin.
- Osmosis froze 22.65 BTC tied to the attacker’s address through an emergency validator upgrade and paused minting, redemptions, and Nomic-related deposits.
- The exploit left roughly 36% of Osmosis’s Alloyed BTC (allBTC) without bitcoin actually backing it.
Nomic is a bridge that lets bitcoin move onto the Cosmos ecosystem as nBTC, a token meant to be backed one-to-one by real BTC held in reserve. On or around September 7 and 8, an attacker found a bug in Nomic’s custom forwarding mechanism and used it to double-spend nBTC, effectively minting vouchers for bitcoin that was never actually deposited.
Those fraudulent vouchers flowed into Osmosis’s Alloyed BTC contract, a pooled asset that blends bitcoin representations from multiple bridges into one liquid token. Osmosis said in a statement that “an attacker was able to double-spend Nomic’s Bitcoin-backed asset, nBTC, and send false vouchers onto Osmosis,” while clarifying that “Osmosis contracts and the Inter-Blockchain Communication (IBC) protocol were not compromised.”
“Osmosis contracts and the Inter-Blockchain Communication (IBC) protocol were not compromised.”
In plain terms: the flaw sat in Nomic’s bridge logic, not in Osmosis’s own code or in the broader IBC messaging standard that connects Cosmos chains to each other.
Osmosis responded by freezing 22.65 BTC linked to the attacker’s address through an emergency validator upgrade, and pausing minting, redemptions, and new Nomic deposits while it sorts out the damage. Trading of bitcoin-linked assets in existing liquidity pools stayed live, with a warning attached about elevated risk. The exploit reduced Alloyed BTC’s real backing to around 64%, meaning roughly 36% of the token in circulation currently has no bitcoin behind it. Osmosis has proposed a governance vote to seize the frozen bitcoin, along with community pool funds, to restore the peg to one-to-one. As of this writing, neither Osmosis nor Nomic has published a full post-mortem.
Disclaimer: Cryip's content is strictly for educational and informational purposes and does not constitute financial, legal, or investment advice. Cryptocurrency involves significant risk, and readers assume full responsibility for their own financial decisions. Asset references are never endorsements.
To make complex crypto topics accessible to readers at all experience levels, our team uses AI tools strictly to refine language, correct grammar, and simplify terminology. AI is never used to draft facts, source information, or form conclusions. Every article is fact-checked and approved by a human editor before publication. Read our full AI Use & Content Policy.
