Osmosis has frozen 22.65 BTC in an attacker’s address after a bug in the Nomic bridge let a double-spend of nBTC leave its Alloyed BTC asset, allBTC, roughly 36% unbacked. Osmosis confirmed the exploit and the freeze in a statement on X.
The bug sat in a custom forwarding mechanism on Nomic, which issues nBTC, a Bitcoin representation backed by BTC in Nomic’s custody. It let the attacker mint false nBTC vouchers with no real Bitcoin behind them and send them to Osmosis. Osmosis said neither its chain nor IBC, Cosmos’s cross-chain messaging protocol, was compromised.
Once the false vouchers were noticed, Osmosis’s moderation subDAOs froze inflows and outflows to both Nomic and allBTC, and validators ran an emergency upgrade to freeze 22.65 BTC in the attacker’s address, Osmosis said. Minting and redemption of allBTC, the exchange’s basket of bridged Bitcoin assets, are paused.
The scale is limited. 39.84 nBTC of the minted total sits inside allBTC, representing about 36% of its backing, according to Osmosis. An on-chain trace published by the researcher Rarma puts the asset at 63.97% backed: 110.57 allBTC in circulation against 70.73 BTC of real collateral.
The freeze does not cover everything taken. Rarma’s trace shows roughly 18 BTC was already drained through Osmosis’s allBTC transmuter pool in June, bridged to Ethereum and sent to Tornado Cash, receiving 671.75 ETH, of which 671.10 ETH went into the mixer. The 22.65 BTC frozen on Osmosis is the part the attacker converted to allBTC on July 17 and never moved.
Recovery now runs through governance. Osmosis said it will propose seizing the frozen assets and ask governance to use accrued BTC in the community pool to restore full allBTC backing. Even with the full 22.65 BTC recovered, about 17.19 BTC from the community pool would still be needed to replace the 39.84 BTC impairment. No seizure or recapitalisation proposal appeared among Osmosis’s latest 20 on-chain proposals as of September 9, so the plan is announced intent only.
The disclosure came more than two months after the exploit activity, which an on-chain trace dates to June 25, 2026. Nomic itself has been halted since September 7, and its outstanding nBTC is only 1.92% backed against a 0.78 BTC reserve. Why the chain stopped is not established.
