CryptoSlate
Osmosis has frozen 22.65 BTC after a flaw in Nomic's custom forwarding logic let an attacker double-spend, leaving the allBTC asset partly unbacked. The disclosure came more than two months after on-chain researcher Rarma traced the principal minting to a June 25 transaction, with 22.65 allBTC created in July 17 activity still unmoved when the trace went public. Nomic and allBTC inflows and outflows are frozen, and minting and redemption are paused.
Osmosis said the nBTC in the basket was created from false vouchers, putting 36.03% of allBTC's backing in question. At the cutoff, 110.57 allBTC was in circulation against 39.84 nBTC and roughly 70.73 BTC-equivalent of other backing. SlowMist's incident database classified the event as a Nomic bridge double-spend.
Why it matters
The bug was in Nomic's forwarding code, not in the Osmosis chain or the Inter-Blockchain Communication protocol, a distinction that matters because it narrows the blast radius to the bridge itself rather than the broader Cosmos stack. Even so, allBTC holders remain collectively exposed: claims on the basket still exceed its valid BTC-equivalent assets until governance acts.
Market impact
Osmosis said it plans to ask governance to confiscate the frozen 22.65 BTC and draw Bitcoin from the community pool to cover the rest. If the full frozen amount is recovered, the basket still needs about 17.19 BTC to repair the 39.84 BTC impairment, and no matching seizure or recapitalization measure had appeared among the latest 20 on-chain proposals as of Sept. 9. Redemption at full parity now hinges on that governance vote and the size of any community-pool contribution, with no realized haircut yet imposed on holders.
Frequently asked questions
-
How much BTC did Osmosis freeze?
Osmosis froze 22.65 BTC after a flaw in Nomic's forwarding logic let an attacker double-spend and put part of the allBTC reserve in question.
-
What is the gap in allBTC's backing?
Osmosis said 36.03% of allBTC's backing was in tainted nBTC created from false vouchers, with 110.57 allBTC in circulation against 39.84 nBTC and roughly 70.73 BTC-equivalent of other assets at the cutoff.
-
Was the Osmosis chain or IBC protocol hacked?
Osmosis stated that neither its chain nor the Inter-Blockchain Communication protocol was compromised. The bug sat in Nomic's forwarding code, and SlowMist's incident database classified it as a Nomic bridge double-spend.
-
What is the recovery plan?
Osmosis plans to ask governance to confiscate the frozen 22.65 BTC and use Bitcoin from the community pool to cover the rest. Even if the full frozen amount is recovered, about 17.19 BTC is still needed to repair the 39.84 BTC impairment.
-
When did the exploit activity happen?
On-chain researcher Rarma traced the principal minting to a June 25 transaction, with 22.65 allBTC created during July 17 activity still unmoved when the trace was published. Osmosis disclosed the event publicly more than two months later.
WuBlockchain
TheBlock
CoinDesk