Osmosis says an exploit on the Nomic chain allowed an attacker to create 40.650602 BTC worth of nBTC on Osmosis without any bitcoin backing, leaving the allBTC asset on Osmosis 36% unbacked. According to the project, the attack happened on June 25 and was not identified until 74 days later.
The issue surfaced only after Nomic was halted, prompting Osmosis to review the chain’s holdings. Osmosis said its own systems and IBC were not compromised, and attributed the problem to a bug in Nomic’s custom forwarding mechanism that let the attacker double-spend nBTC.
Exploit centered on Nomic forwarding bug
In Osmosis’ account, the attacker chained together two separate bugs on Nomic to produce a transaction that effectively minted unbacked nBTC on Osmosis. The result was more than 40 BTC worth of tokens created “out of thin air,” despite no corresponding BTC reserves existing behind them.
That meant users on Osmosis were dealing with an asset whose backing no longer matched the number of tokens in circulation. After the discrepancy was uncovered, Osmosis said allBTC was left 36% undercollateralized.
Most of the loss went unnoticed for weeks
Neither project appears to have detected or publicly disclosed the shortfall during the 74 days between the June 25 attack and Osmosis’ later discovery. The exploit became known only after Nomic stopped operating, which led Osmosis to investigate balances and uncover the missing backing.
The source article also notes signs that Nomic may not be under active maintenance. Its X account last posted in 2024, and its GitHub repository reportedly has not seen a code commit in years.
Attacker cashed out part of the proceeds
Osmosis said the exploiter was able to realize roughly $1 million at the time by moving 671 ETH through Ethereum to Tornado Cash. That portion appears to be beyond immediate recovery based on the project’s description.
At the same time, not all of the proceeds left the ecosystem. Osmosis said 22.65 allBTC remained in the attacker’s account and was frozen earlier this week through what it described as an emergency upgrade.
Proposal aims to restore backing
A governance forum post outlines how Osmosis proposes to close the roughly 40 BTC gap in allBTC backing. The plan includes seizing the 22.65 allBTC frozen from the attacker and applying it toward the deficit.
Beyond that, Osmosis proposes canceling a pending liquidity re-deployment involving USDC.noble and using additional allBTC from the Community Pool. Those steps, if approved, would be used to make up the remaining shortfall created by the exploit.
What comes next
The next confirmed step is governance review of Osmosis’ proposed recovery measures. Based on the forum post, the project is attempting to determine how much of the hole can be covered with seized funds and how much would need to come from treasury-style resources.
What remains clear from Osmosis’ disclosure is that the exploit was tied to Nomic rather than to Osmosis or IBC directly, and that the full impact only became visible after Nomic’s halt forced a closer examination of reserves.
Source: protos.com