{"investigation":{"slug":"osmosis-allbtc-nomic-bridge-double-spend-exploit-september-2026","entity_name":"Osmosis (allBTC / Nomic Bridge Double-Spend Exploit, September 2026)","trust_score":23,"severity_base":null,"score_modifier":-15,"confidence":0.82,"status":"under_investigation","content_type":"investigation","summary":"In September 2026, Osmosis disclosed that a double-spend flaw in Nomic's custom Bitcoin bridge forwarding logic had allowed an attacker to mint roughly 39.8-40.65 unbacked nBTC and move it into Osmosis's alloyed Bitcoin (allBTC) basket, impairing an estimated 36% of allBTC's collateral. Osmosis said the underlying attack activity dated to late June 2026 but was not publicly disclosed until September 9, 2026, a gap of roughly 74 days; Osmosis and independent researchers attribute the flaw to Nomic's bridge code rather than to a compromise of the Osmosis chain or IBC itself. Osmosis froze 22.65 BTC tied to the attacker's address via an emergency validator upgrade and proposed a governance vote to seize those funds plus a community-pool top-up to restore full backing, but as of the most recent reporting that remediation had not been executed.","sections":[{"content":"According to Osmosis and multiple news outlets, a flaw in Nomic's custom cross-chain transaction forwarding mechanism allowed the same Bitcoin deposit to be credited twice, with the duplicate credit producing spendable, unbacked nBTC (Nomic's Bitcoin-pegged token). Independent on-chain researcher 'Rarma' found that the attacker exploited this flaw across roughly 25 inter-network transfers, minting approximately 40.65 BTC worth of nBTC with no underlying Bitcoin behind it; Osmosis's own figure, cited by CryptoBriefing and other outlets, was approximately 39.84 BTC. This unbacked nBTC was deposited into Osmosis's 'alloyed BTC' (allBTC) basket, a pooled synthetic Bitcoin token that is supposed to be backed 1:1 by various Bitcoin-pegged assets on Osmosis. Reporting from CryptoSlate and Forklog put allBTC circulation at roughly 110.57 tokens against the compromised nBTC making up about 36.03% of the basket's nominal backing, leaving roughly 70.73 BTC-equivalent of other, apparently valid, collateral. Osmosis responded by halting Nomic and allBTC deposits, withdrawals, minting and redemption, and by pushing an emergency validator-coordinated upgrade that froze 22.65 BTC still sitting in an address linked to the attacker before it could be moved further. Osmosis and Nomic both stated that the Osmosis chain and the Inter-Blockchain Communication (IBC) protocol itself were not directly compromised; the vulnerability was isolated to Nomic's custom bridge code.","heading":"The Nomic Double-Spend Exploit and allBTC Freeze","sources":[{"url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","name":"CryptoBriefing: Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"CryptoSlate: Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves","type":"news_article","credibility":2},{"url":"https://forklog.com/en/alloyed-btc-token-on-osmosis-loses-36-collateral-due-to-nomic-exploit/","name":"Forklog: Alloyed BTC token on Osmosis loses 36% collateral due to Nomic exploit","type":"news_article","credibility":2},{"url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","name":"eGamers: allBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend","type":"news_article","credibility":2},{"url":"https://en.coinotag.com/osmosis-nomic-exploit-40-65-bitcoin-btc-nbtc-unbacked-74-days","name":"CoinoTag: Osmosis Nomic exploit — 40.65 Bitcoin (BTC) in nBTC unbacked for 74 days","type":"news_article","credibility":2}],"severity":"high"},{"content":"Multiple outlets, including Protos, Bitcoin.com News and CoinoTag, reported that the underlying minting activity occurred on or around June 25, 2026, but was not publicly disclosed until on-chain researcher Rarma published an analysis on September 8, 2026, followed by an Osmosis security update on September 9, 2026 — a gap of approximately 74 days. Protos's headline framed this directly as 'Osmosis took 74 days to discover 40-BTC Nomic exploit.' Reporting attributes part of the detection delay to Nomic's own reduced activity: Protos noted that Nomic's last public social media post predated the incident by roughly two years and its GitHub repository had seen no recent commits, raising questions about ongoing monitoring of the bridge. Osmosis's public disclosure came only after Nomic halted its own protocol and after independent research surfaced the discrepancy, rather than through proactive detection by either project. None of the sources reviewed could confirm the exact date detection first occurred internally, only that public disclosure followed Rarma's September 8 analysis.","heading":"Disclosure Lag: Roughly 74 Days Between Exploit and Public Notice","sources":[{"url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","name":"Protos: Osmosis took 74 days to discover 40-BTC Nomic exploit","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/bitcoin-fund-lost-36-of-its-backing-nobody-noticed-for-74-days/","name":"Bitcoin.com News: Bitcoin fund lost 36% of its backing, nobody noticed for 74 days","type":"news_article","credibility":2},{"url":"https://en.coinotag.com/osmosis-nomic-exploit-40-65-bitcoin-btc-nbtc-unbacked-74-days","name":"CoinoTag: Osmosis Nomic exploit — 40.65 Bitcoin (BTC) in nBTC unbacked for 74 days","type":"news_article","credibility":2}],"severity":"high"},{"content":"Once the exploit came to public light, Osmosis coordinated with its validator set on an emergency chain upgrade that froze 22.65 BTC held in an address linked to the attacker, preventing it from being moved further. Osmosis simultaneously paused all allBTC minting, redemption, deposits and withdrawals, and halted inflows and outflows tied to Nomic, according to CryptoBriefing and eGamers. Researcher Rarma's trace, cited by Forklog and eGamers, indicated that a separate portion of the exploited funds — roughly 671 ETH — had already moved across bridges to Ethereum and was sent to the Tornado Cash mixing service before the freeze, meaning it fell outside the recoverable 22.65 BTC. eGamers also reported that allBTC's pause authority rests with a 3-of-6 moderator subDAO empowered to halt the pool or flag a constituent asset, and that this subDAO exercised that power to freeze the compromised funds pending a formal governance process.","heading":"Emergency Response and Partial Fund Freeze","sources":[{"url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","name":"CryptoBriefing: Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC","type":"news_article","credibility":2},{"url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","name":"eGamers: allBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend","type":"news_article","credibility":2},{"url":"https://forklog.com/en/alloyed-btc-token-on-osmosis-loses-36-collateral-due-to-nomic-exploit/","name":"Forklog: Alloyed BTC token on Osmosis loses 36% collateral due to Nomic exploit","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Osmosis stated its intended two-step remediation plan: first, a governance proposal to formally seize the 22.65 BTC frozen in the attacker's address; second, drawing on Bitcoin accumulated in the Osmosis community pool to cover the remaining shortfall and restore allBTC to full 1:1 backing. Multiple outlets calculated that even full recovery of the frozen 22.65 BTC would leave an approximately 17.19 BTC gap (out of the roughly 39.84 BTC total impairment) that would need to come from the community pool. As of the most recent reporting reviewed (around September 9-10, 2026), eGamers and CryptoSlate both noted that none of the 20 most recent on-chain governance proposals on Osmosis contained a corresponding seizure or recapitalization measure, meaning the proposed fix had not yet been formally submitted, let alone voted on or executed. No source reviewed for this report confirms that allBTC minting and redemption have since resumed or that the shortfall has been fully covered; this should be treated as an open, unresolved item pending direct confirmation from Osmosis governance records or official channels.","heading":"Proposed Governance Remediation Remains Unexecuted","sources":[{"url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","name":"eGamers: allBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"CryptoSlate: Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","name":"CryptoBriefing: Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC","type":"news_article","credibility":2}],"severity":"high"},{"content":"Osmosis and the independent researcher who surfaced the exploit both attributed the vulnerability to Nomic's bridge implementation rather than to Osmosis's own blockchain, its smart contracts, or the IBC protocol used to move assets between Cosmos chains. Per Forklog's reporting of Rarma's analysis, the flaw sat in one of 18 similar deposit-forwarding code paths in Nomic's system; only this single path allowed the same deposit to be credited twice, and the system additionally failed to verify who controlled the receiving account. Nomic's own documentation describes nBTC as designed to be backed 'exactly 1:1' by Bitcoin held in a decentralized, validator-controlled multisig custody reserve, with safeguards including a greater-than-90%-of-voting-power signing threshold for reserve disbursals and circuit breakers that halt signing if large amounts leave the reserve within 24 hours. The documentation does not describe the specific forwarding mechanism implicated in the exploit, meaning the flaw was apparently in supplementary bridge-forwarding logic not detailed in Nomic's public documentation. This episode illustrates a recurring category of DeFi risk: assets that are nominally 'backed 1:1' by a bridge can still become partially unbacked if the bridge's forwarding or accounting logic contains an exploitable defect, even when the receiving protocol (Osmosis) and the underlying messaging layer (IBC) function as intended.","heading":"Root Cause: Third-Party Bridge Risk, Not a Direct Osmosis Chain Compromise","sources":[{"url":"https://forklog.com/en/alloyed-btc-token-on-osmosis-loses-36-collateral-due-to-nomic-exploit/","name":"Forklog: Alloyed BTC token on Osmosis loses 36% collateral due to Nomic exploit","type":"news_article","credibility":2},{"url":"https://docs.nomic.io/bitcoin","name":"Nomic documentation: Bitcoin bridge design","type":"official","credibility":2},{"url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","name":"CryptoBriefing: Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC","type":"news_article","credibility":2}],"severity":"medium"},{"content":"This was not Osmosis's first security incident. In June 2022, a bug in Osmosis's liquidity pool share calculation — introduced in the chain's v9 upgrade — allowed liquidity providers to withdraw roughly 50% more value than they had deposited, with no bonding period to limit abuse. The Osmosis core team and validators halted the chain at block 4,713,064 to stop the exploit; The Block and Decrypt both reported the loss at approximately $5 million, with The Defiant reporting that four attackers were responsible for at least 95% of the stolen funds and that two attackers later said they would return what they took. Osmosis said at the time that losses would be covered from its strategic reserve rather than the community pool. Separately, in December 2023, Levana, a perpetuals protocol built on top of Osmosis (not a flaw in Osmosis's core chain itself), lost more than $1.1 million after attackers combined a fee-market congestion issue on Osmosis with stale pricing in Levana's oracle integration, according to The Block. Taken together with the 2026 Nomic/allBTC incident, Osmosis's history shows a mix of vulnerabilities directly in its own core protocol (2022) and vulnerabilities in third-party bridges or protocols built on or connected to Osmosis (2023 Levana; 2026 Nomic/allBTC).","heading":"Broader Context: Prior Osmosis Security History","sources":[{"url":"https://www.theblock.co/post/150752/osmosis-dex-on-cosmos-exploited-for-5-million-as-validators-halt-the-network","name":"The Block: Osmosis DEX on Cosmos exploited for $5 million as validators halt the network","type":"news_article","credibility":1},{"url":"https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit","name":"Decrypt: Cosmos-Based DeFi Exchange Osmosis Hit by $5M Exploit","type":"news_article","credibility":2},{"url":"https://thedefiant.io/osmosis-5m-exploit","name":"The Defiant: Osmosis Exploited For $5M Due To Contract Bug","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2022-06","event":"Osmosis liquidity pool bug exploited for roughly $5 million; chain halted by validators","source":"The Block","source_url":"https://www.theblock.co/post/150752/osmosis-dex-on-cosmos-exploited-for-5-million-as-validators-halt-the-network","date_evidence":"The attack occurred two blocks before developers halted the Osmosis blockchain at about 10:49 pm EST, at block height 4,713,064.","date_original":"2022-06-08"},{"date":"2023-12","event":"Levana, a perpetuals protocol on Osmosis, loses over $1.1 million in an attack combining an Osmosis fee-market issue with stale oracle pricing","source":"The Block","source_url":"https://www.theblock.co/post/269455/levana-protocol-exploited-osmosis"},{"date":"2026-06","event":"Attacker exploits double-spend flaw in Nomic's bridge forwarding logic, minting approximately 39.84-40.65 BTC worth of unbacked nBTC across roughly 25 transfers into Osmosis's allBTC basket","source":"CryptoSlate / Forklog, citing researcher Rarma","source_url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","date_evidence":"the main attack occurred on June 25, when the attacker created about 40.65 nBTC","date_original":"2026-06-25"},{"date":"2026-07","event":"A 22.65 BTC portion of the exploited nBTC is converted into allBTC and remains at an identifiable Osmosis address","source":"eGamers, citing researcher Rarma","source_url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","date_evidence":"22.65060846 allBTC generated during activity on July 17","date_original":"2026-07-17"},{"date":"2026-09","event":"Nomic and allBTC pool operations halted","source":"Forklog","source_url":"https://forklog.com/en/alloyed-btc-token-on-osmosis-loses-36-collateral-due-to-nomic-exploit/","date_evidence":"Nomic and allBTC pool operations were halted on September 7.","date_original":"2026-09-07"},{"date":"2026-09","event":"Independent researcher Rarma publishes on-chain analysis tracing the unbacked nBTC and allBTC shortfall","source":"Bitcoin.com News","source_url":"https://news.bitcoin.com/security/bitcoin-fund-lost-36-of-its-backing-nobody-noticed-for-74-days/","date_original":"2026-09-08"},{"date":"2026-09","event":"Osmosis publicly discloses the exploit, freezes 22.65 BTC via emergency validator upgrade, and pauses allBTC minting, redemption, deposits and withdrawals","source":"CryptoBriefing / eGamers","source_url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","date_evidence":"suspended key operations for its synthetic Bitcoin asset on September 9","date_original":"2026-09-09"},{"date":"2026-09","event":"News outlets report that, as of the 20 most recent on-chain proposals, no governance seizure or recapitalization measure had yet been submitted","source":"eGamers / CryptoSlate","source_url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","date_original":"2026-09-10"}],"sources_used":[{"url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/","name":"CryptoBriefing: Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/","name":"CryptoSlate: Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves","type":"news_article","credibility":2},{"url":"https://forklog.com/en/alloyed-btc-token-on-osmosis-loses-36-collateral-due-to-nomic-exploit/","name":"Forklog: Alloyed BTC token on Osmosis loses 36% collateral due to Nomic exploit","type":"news_article","credibility":2},{"url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/","name":"eGamers: allBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend","type":"news_article","credibility":2},{"url":"https://en.coinotag.com/osmosis-nomic-exploit-40-65-bitcoin-btc-nbtc-unbacked-74-days","name":"CoinoTag: Osmosis Nomic exploit — 40.65 Bitcoin (BTC) in nBTC unbacked for 74 days","type":"news_article","credibility":2},{"url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/","name":"Protos: Osmosis took 74 days to discover 40-BTC Nomic exploit","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/bitcoin-fund-lost-36-of-its-backing-nobody-noticed-for-74-days/","name":"Bitcoin.com News: Bitcoin fund lost 36% of its backing, nobody noticed for 74 days","type":"news_article","credibility":2},{"url":"https://docs.nomic.io/bitcoin","name":"Nomic documentation: Bitcoin bridge design","type":"official","credibility":2},{"url":"https://decrypt.co/102300/cosmos-based-defi-exchange-osmosis-hit-by-5m-exploit","name":"Decrypt: Cosmos-Based DeFi Exchange Osmosis Hit by $5M Exploit","type":"news_article","credibility":2},{"url":"https://thedefiant.io/osmosis-5m-exploit","name":"The Defiant: Osmosis Exploited For $5M Due To Contract Bug","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/150752/osmosis-dex-on-cosmos-exploited-for-5-million-as-validators-halt-the-network","name":"The Block: Osmosis DEX on Cosmos exploited for $5 million as validators halt the network","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/269455/levana-protocol-exploited-osmosis","name":"The Block: Levana protocol exploited (Osmosis)","type":"news_article","credibility":1}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-14T23:34:45.032174+00:00","updated_at":"2026-10-30T12:40:50.734+00:00"},"source_quality":{"total":12,"tier1":0,"tier2":3,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-10-30T12:40:51.244Z","last_fact_checked_at":"2026-10-30T12:40:50.970Z","fact_check_next_allowed_at":"2026-11-06T12:40:50.970Z","update_next_allowed_at":"2026-11-03T04:44:27.733Z"}