{"investigation":{"slug":"osmosis-allbtc-nomic-bridge-double-spend","entity_name":"Osmosis (allBTC / Nomic Bridge Double-Spend)","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"draft","content_type":"investigation","summary":"In September 2026, Osmosis, a Cosmos-based decentralized exchange, froze minting, redemption, deposits and withdrawals of its alloyed Bitcoin token (allBTC) after discovering that a double-spend flaw in the Nomic chain's Bitcoin-forwarding mechanism had allowed an attacker to mint tens of millions of dollars in unbacked nBTC months earlier. On-chain analysis traced the exploit's origin to June 25, 2026, with the shortfall (roughly 36% of allBTC's backing) only disclosed publicly on September 9-10, 2026 — a disclosure gap of about 74 days during which allBTC continued trading and was represented as fully Bitcoin-backed. Osmosis says its own chain and the IBC protocol were not directly compromised and has proposed a governance-driven remediation using seized attacker funds and community-pool Bitcoin, but as of this writing the fix remains a pending proposal rather than a completed restoration.","sections":[{"content":"On September 9, 2026, Osmosis paused deposits, withdrawals, minting and redemption for its alloyed Bitcoin token (allBTC) after detecting a discrepancy in its Bitcoin backing. The cause was identified as a double-spend vulnerability in a custom transaction-forwarding mechanism on the Nomic chain, the Cosmos-based Bitcoin bridge that mints nBTC (a token nominally backed 1:1 by BTC held in a validator-controlled multisig) and supplies it as one of the underlying assets in Osmosis's allBTC \"alloyed\" token. Osmosis stated that an attacker combined two separate bugs in Nomic's forwarding logic to double-spend nBTC, generating false vouchers that were then sent to and accepted by Osmosis in exchange for legitimately-backed allBTC. Osmosis said its own chain and the Inter-Blockchain Communication (IBC) protocol were not themselves compromised, characterizing the flaw as confined to Nomic's custom code. In total, the exploit is reported to have generated approximately 39.84-40.65 nBTC (sources vary slightly, roughly $3.15 million at the time) with no real Bitcoin behind it, equal to about 36% of allBTC's total backing.","heading":"The Nomic Double-Spend Exploit and allBTC Freeze","sources":[{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves - CryptoSlate","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/","name":"Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing - CryptoTimes","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/","name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked - Coinpaprika","type":"news_article","credibility":2},{"url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC - Blockfence","type":"research","credibility":2}],"severity":"critical"},{"content":"On-chain researcher 'Rarma' traced the principal fraudulent minting activity to June 25, 2026, with a related 22.65060846 nBTC/allBTC balance from activity around July 17, 2026 that reportedly sat unmoved in the attacker's address. Osmosis's own September 10, 2026 governance proposal reportedly acknowledges the mint occurred on June 25 and states the discrepancy was not discovered until Nomic halted operations around September 7, 2026, at which point a backing check exposed the gap — an approximately 74-day period in which the exploit went undetected and undisclosed. Reporting from Protos and others frames this as a significant transparency failure: allBTC continued to trade and be represented as fully Bitcoin-backed to holders and traders during this window, meaning anyone acquiring or holding allBTC in that period was doing so without knowledge that roughly a third of its backing was compromised. This is an alleged characterization based on on-chain reconstruction and journalistic analysis rather than a formal audit finding, and Osmosis has not been reported disputing the June 25 origin date.","heading":"Disclosure Lag: 74 Days Between Exploit and Public Notice","sources":[{"url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","name":"Osmosis took 74 days to discover 40-BTC Nomic exploit - Protos","type":"news_article","credibility":2},{"url":"https://en.coinotag.com/osmosis-nomic-exploit-40-65-bitcoin-btc-nbtc-unbacked-74-days","name":"Osmosis Reveals 40.65 Bitcoin (BTC) Exploit on Nomic Bridge Found After 74 Days - COINOTAG","type":"news_article","credibility":2},{"url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC - Blockfence","type":"research","credibility":2}],"severity":"high"},{"content":"Following disclosure, Osmosis's management subDAO halted Nomic and allBTC inflows/outflows, and validators coordinated an emergency network upgrade (reported as v31.1.0) that froze approximately 22.65 BTC still sitting in an attacker-controlled address before it could be moved further. However, reporting indicates the attacker had already moved funds through roughly 25 cross-chain transfers and laundered a portion — approximately 671 ETH (roughly $1 million at the time) — through Tornado Cash, an Ethereum mixing service. This leaves an estimated 17-18 BTC of the compromised backing unrecovered and likely unrecoverable through direct seizure, on top of the 22.65 BTC that remains frozen but not yet formally confiscated.","heading":"Emergency Response and Partial Fund Freeze","sources":[{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves - CryptoSlate","type":"news_article","credibility":2},{"url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC - Blockfence","type":"research","credibility":2},{"url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","name":"Osmosis took 74 days to discover 40-BTC Nomic exploit - Protos","type":"news_article","credibility":2}],"severity":"high"},{"content":"On or around September 10, 2026, Osmosis put forward a governance proposal outlining a two-step remediation: first, a future software upgrade to formally seize the 22.65 BTC frozen in the attacker's address; second, use of Bitcoin held in the Osmosis community pool to cover the remaining approximately 17.19 BTC shortfall, alongside marking the corrupted nBTC inside the allBTC transmuter contract for withdrawal and burn. As of the most recent reporting, this remains a governance proposal requiring a community vote and has not yet been executed — meaning allBTC holders were, at time of writing, still exposed to an unresolved backing shortfall pending a future vote and technical upgrade. This is a real-time, ongoing situation and the outcome of the governance vote (and whether the community pool draw is approved and sufficient) is not yet resolved as of this investigation.","heading":"Proposed Governance Remediation Remains Unexecuted","sources":[{"url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144","name":"Cosmos Ecosystem DEX Osmosis Proposes to Restore Alloyed BTC Peg via Community Pool and Seizing Attacker Assets - PANews","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/","name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked - Coinpaprika","type":"news_article","credibility":2}],"severity":"high"},{"content":"Osmosis has publicly stated that neither its own blockchain nor the IBC protocol it uses for cross-chain transfers was breached; the vulnerability originated in Nomic's custom Bitcoin-forwarding code, a component Osmosis relies on but does not itself control. Nomic markets itself as a trust-minimized Bitcoin bridge that uses an in-protocol Bitcoin light client and validator multisig custody rather than a fully custodial model. This incident nonetheless illustrates a structural risk in Osmosis's alloyed-asset design: allBTC's backing depends on the security of externally-developed bridge software (Nomic) that Osmosis does not directly audit or control, and a flaw in that upstream component was sufficient to compromise over a third of allBTC's backing without any exploit of Osmosis's own code.","heading":"Root Cause: Third-Party Bridge Risk, Not a Direct Osmosis Chain Compromise","sources":[{"url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC - Blockfence","type":"research","credibility":2},{"url":"https://docs.nomic.io/bitcoin","name":"Nomic Bitcoin Decentralized Custody Docs","type":"official","credibility":2}],"severity":"medium"},{"content":"This is not Osmosis's first security incident. In June 2022, Osmosis suffered an approximately $5 million exploit caused by a bug that allowed liquidity providers to withdraw roughly 50% more than their deposited amount without a bonding period; validators coordinated an emergency chain halt within about 12 minutes, limiting losses and later facilitating fund recovery through negotiation with exploiters. That 2022 incident and the 2026 Nomic-linked allBTC shortfall are separate events with different root causes (an internal smart-contract logic bug in 2022 versus an external bridge partner's forwarding-logic flaw in 2026), but both demonstrate recurring exposure to protocol-level and cross-chain bridge risk in Osmosis's architecture. The September 2026 Nomic/allBTC incident is also distinct from the unrelated, larger DPRK-linked Drift Protocol hack reported in April 2026 (~$285 million), which involved a different protocol entirely.","heading":"Broader Context: Prior Osmosis Security History","sources":[{"url":"https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit","name":"Cosmos-based DeFi Exchange Osmosis Hit by $5M Exploit - Decrypt","type":"news_article","credibility":2},{"url":"https://thedefiant.io/osmosis-5m-exploit","name":"Osmosis Exploited For $5M Due To Contract Bug - The Defiant","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2022-06","event":"Osmosis suffers a separate, unrelated ~$5 million exploit due to a liquidity-pool share-calculation bug; validators halt the chain within minutes to limit losses.","source":"Decrypt","source_url":"https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit"},{"date":"2026-06","event":"Alleged origin of the Nomic double-spend exploit: an attacker mints approximately 39.84-40.65 nBTC with no real Bitcoin backing by exploiting a flaw in Nomic's custom Bitcoin-forwarding mechanism, per on-chain researcher Rarma's trace and Osmosis's own governance proposal.","source":"Protos / Blockfence","source_url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","date_original":"2026-06-25"},{"date":"2026-07","event":"Additional exploit-linked activity identified: a balance of approximately 22.65060846 allBTC tied to the exploit is reported to have sat unmoved in the attacker's address from this date.","source":"On-chain trace by researcher Rarma, reported via Protos/Blockfence","source_url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","date_original":"2026-07-17"},{"date":"2026-09","event":"Nomic chain halts, triggering a backing check that exposes the shortfall in allBTC's Bitcoin reserves.","source":"Protos","source_url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","date_original":"2026-09-07"},{"date":"2026-09","event":"Osmosis publicly discloses the Nomic double-spend exploit and pauses allBTC deposits, withdrawals, minting and redemption; an emergency chain upgrade freezes 22.65 BTC at the attacker-controlled address.","source":"CryptoSlate / CryptoTimes","source_url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","date_original":"2026-09-09"},{"date":"2026-09","event":"Osmosis puts forward a governance proposal to seize the frozen 22.65 BTC and use community-pool Bitcoin to cover the remaining ~17.19 BTC shortfall in allBTC's backing.","source":"PANews","source_url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144","date_original":"2026-09-10"}],"sources_used":[{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves - CryptoSlate","type":"news_article","archive_url":"http://web.archive.org/web/20260911144001/https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","credibility":2,"archive_timestamp":"2026-09-11T14:40:01+00:00"},{"url":"https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/","name":"Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing - CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260915041441/https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/","credibility":2,"archive_timestamp":"2026-09-15T04:14:41+00:00"},{"url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/","name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked - Coinpaprika","type":"news_article","archive_url":"https://web.archive.org/web/20260915040754/https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/","credibility":2,"archive_timestamp":"2026-09-15T04:07:54+00:00"},{"url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","name":"Osmosis took 74 days to discover 40-BTC Nomic exploit - Protos","type":"news_article","archive_url":"https://web.archive.org/web/20260915091000/https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","credibility":2,"archive_timestamp":"2026-09-15T09:10:00+00:00"},{"url":"https://en.coinotag.com/osmosis-nomic-exploit-40-65-bitcoin-btc-nbtc-unbacked-74-days","name":"Osmosis Reveals 40.65 Bitcoin (BTC) Exploit on Nomic Bridge Found After 74 Days - COINOTAG","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC - Blockfence","type":"research","archive_url":"https://web.archive.org/web/20260915013317/https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/","credibility":2,"archive_timestamp":"2026-09-15T01:33:17+00:00"},{"url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144","name":"Cosmos Ecosystem DEX Osmosis Proposes to Restore Alloyed BTC Peg via Community Pool and Seizing Attacker Assets - PANews","type":"news_article","archive_url":"https://web.archive.org/web/20260915064110/https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144","credibility":2,"archive_timestamp":"2026-09-15T06:41:10+00:00"},{"url":"https://docs.nomic.io/bitcoin","name":"Nomic Bitcoin Decentralized Custody Docs","type":"official","archive_url":"https://web.archive.org/web/20260915013723/https://docs.nomic.io/bitcoin","credibility":2,"archive_timestamp":"2026-09-15T01:37:23+00:00"},{"url":"https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit","name":"Cosmos-based DeFi Exchange Osmosis Hit by $5M Exploit - Decrypt","type":"news_article","archive_url":"https://web.archive.org/web/20260915090335/https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit","credibility":2,"archive_timestamp":"2026-09-15T09:03:35+00:00"},{"url":"https://thedefiant.io/osmosis-5m-exploit","name":"Osmosis Exploited For $5M Due To Contract Bug - The Defiant","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-14T23:24:06.196931+00:00","updated_at":"2026-09-15T09:13:04.12926+00:00"}}