Key Takeaways
- Osmosis froze 22.65 BTC worth roughly $1.8 million after an attacker exploited a double-spend vulnerability involving Nomic’s nBTC.
- The wider incident affected 39.84 nBTC, representing approximately 36% of the Bitcoin backing Osmosis’ Alloyed BTC product.
- Osmosis said neither its blockchain nor the Inter-Blockchain Communication protocol was compromised; the vulnerability was in Nomic’s custom forwarding mechanism.
- Osmosis plans to ask governance to seize the frozen Bitcoin and use the community pool BTC to cover the remaining shortfall.
Osmosis has frozen nearly $1.8 million in Bitcoin after an exploit involving Nomic allowed an attacker to double-spend nBTC and send fraudulent vouchers into the Cosmos-based decentralized exchange.
The incident affected 39.84 nBTC, worth roughly $3.15 million at current Bitcoin prices, according to security tracker SlowMist.
Osmosis said that the amount represents around 36% of the backing of Alloyed BTC (allBTC), its product designed to combine different representations of Bitcoin into a single asset.
Osmosis responded by freezing Nomic and allBTC inflows and outflows before coordinating an emergency network upgrade with validators.
The intervention ultimately locked 22.65 BTC, worth approximately $1.8 million, in an address controlled by the attacker.
Attacker Created nBTC That Shouldn’t Have Existed
Importantly, Osmosis itself was not hacked.
According to the protocol, the vulnerability originated in a custom forwarding mechanism on Nomic, a Bitcoin-focused blockchain designed to bring BTC into the Cosmos ecosystem.
The bug allowed an attacker to double-spend nBTC and generate false vouchers that were subsequently transferred to Osmosis.
Osmosis also stressed that IBC, the communication protocol connecting blockchains across Cosmos, was not compromised. Instead, IBC transported information originating from an asset whose backing had already been compromised upstream.
That distinction exposes a broader problem with cross-chain Bitcoin products.
A messaging layer can function exactly as intended while still transmitting assets created through faulty logic elsewhere. Once several bridged versions of BTC are combined into a single product, the security of that product can effectively become dependent on its weakest underlying component.
For allBTC, that weakness became significant because nBTC represented more than a third of its backing.
Osmosis Wants Governance to Seize Frozen Bitcoin
Freezing the attacker’s 22.65 BTC does not automatically return the funds to allBTC holders.
Osmosis said it will submit a governance proposal seeking permission to seize the frozen assets. It will also ask governance to use Bitcoin accumulated in the Osmosis community pool to cover the remaining deficit and restore allBTC’s full backing.
The difference between the 39.84 nBTC affected and 22.65 BTC frozen leaves approximately 17.19 BTC that would need to be accounted for through the recovery process.
Minting and redemptions of allBTC remain suspended while the incident is addressed, although trading in existing BTC liquidity pools has continued.
A detailed post-mortem has not yet been released, leaving questions about exactly how the double-spend was executed and how long the vulnerability existed.
But the incident already demonstrates an uncomfortable reality for bridged Bitcoin: the underlying BTC blockchain does not need to fail for a supposedly Bitcoin-backed asset to lose its backing.
In this case, a bug several layers removed from Bitcoin was enough to put more than a third of an aggregated BTC product’s collateral at risk.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
