A double-spend flaw on the Nomic blockchain let an attacker create false nBTC vouchers that reached Osmosis, forcing the Cosmos-based exchange to freeze its alloyed BTC operations. An emergency upgrade locked 22.65 BTC in the attacker's address, and Osmosis now plans to seize those funds through governance and cover the rest from its community pool.
Osmosis suspended minting, redemption, deposits, and withdrawals for alloyed BTC (allBTC) on September 9 after an exploit on the Nomic blockchain let an attacker double-spend nBTC. An emergency chain upgrade locked 22.65 BTC in the attacker's address before the funds could move further.
What happened and how much is at stake
The exploit hit a flaw in a custom forwarding mechanism on Nomic, a cross-chain bridge chain built to bring Bitcoin into the interchain ecosystem. That flaw let the attacker create false vouchers through a double-spend of nBTC, a wrapped representation of Bitcoin living on Nomic. The fraudulent vouchers then reached Osmosis over the Inter-Blockchain Communication (IBC) protocol, but IBC itself wasn't compromised and Osmosis's own systems weren't breached directly — the vulnerability sat upstream, on Nomic's side.
Approximately 39.84 nBTC were compromised, representing roughly 36% of allBTC's total backing on Osmosis and about 30% of the exchange's total BTC exposure. Trading of BTC in existing liquidity pools has continued despite the freeze, but the halt on minting and redemptions means no one can create new allBTC or cash out existing holdings until the situation is resolved.
The recovery plan
Osmosis has outlined a two-step plan to make affected users whole. First, the team plans to bring a governance vote to seize the 22.65 BTC frozen in the attacker's address, since Cosmos governance proposals can authorize on-chain actions when enough token holders vote in favor. Second, Osmosis intends to tap its community pool to cover the gap between the frozen BTC and the total amount compromised, aiming to restore allBTC's 1:1 backing.
A full incident report and detailed recovery plan are expected in the coming days, though Osmosis hasn't specified a timeline for restoring normal minting and redemption.
Why cross-chain bridges keep breaking
The exploit targeted Nomic's custom forwarding mechanism — exactly the kind of bespoke infrastructure that tends to hide undiscovered vulnerabilities, even when the underlying IBC protocol is battle-tested. Alloyed BTC aggregates multiple bridged versions of BTC into one tradeable token, so a flaw in any single backing asset can threaten the whole product. In this case, nBTC represented enough of allBTC's backing that one exploit put more than a third of the asset's collateral in question.
For now, minting and redemption stay frozen, and full restoration depends on the governance vote passing and the community pool covering the remaining shortfall.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
