Osmosis has suspended transactions involving Nomic and Alloyed BTC after an exploit on the Nomic network exposed a large portion of Alloyed BTC’s backing. The issue did not stem from a breach of Osmosis itself or the IBC protocol, according to the team.

The reported vulnerability let an attacker double-spend nBTC on Nomic and send false vouchers to Osmosis. As a result, 39.84 nBTC entered the system in a way that left Alloyed BTC partially undercollateralized, putting roughly 36% of its reserves at risk.

How the exploit affected Alloyed BTC

Osmosis said the problem originated in a custom forwarding mechanism on Nomic. The flaw allegedly allowed the attacker to reuse the same nBTC more than once and route invalid voucher representations to the decentralized exchange.

That activity affected the backing of Alloyed BTC rather than compromising Osmosis infrastructure. The exchange said the injected 39.84 nBTC represented about 36% of the token’s reserves, creating a shortfall in collateral.

Osmosis and IBC were not hacked

In its explanation of the incident, Osmosis emphasized that neither the DEX nor the Inter-Blockchain Communication protocol was breached. The vulnerability was described as specific to Nomic’s custom transaction-forwarding setup.

That distinction is important for understanding the scope of the event: the reserve issue emerged because false vouchers reached Osmosis from Nomic, not because Osmosis or IBC itself failed at the protocol level.

Emergency response and frozen funds

After identifying the exploit, Osmosis froze inbound and outbound transfers for both Nomic and Alloyed BTC on the platform. The move was aimed at containing further impact while the teams assessed the damage to reserves.

Osmosis also worked with validators on an emergency upgrade. According to the project, that action allowed 22.65 BTC to be frozen at the attacker’s address.

What happens next

The next confirmed step is a governance process. Osmosis plans to submit a proposal asking the community to vote on confiscating the frozen assets recovered through the emergency action.

The team also intends to seek approval to use accumulated bitcoin held in the community pool to cover the remaining deficit and restore full backing for Alloyed BTC. Until those decisions are made, the incident remains a reserve shortfall response rather than a finalized recovery.

Source: incrypted.com