Skip to main content
AVOID.NET
Sign in

Osmosis (allBTC / Nomic Bridge Double-Spend Exploit, September 2026)

avoid.net/osmosis-allbtc-nomic-bridge-double-spend-exploit-september-2026→38/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3zyQM8…Jxj2

Summary

On September 9, 2026, the Cosmos-based DEX Osmosis froze minting, redemption, deposits, and withdrawals for its alloyed Bitcoin token (allBTC) after discovering that a double-spend flaw in the Nomic chain's custom BTC-forwarding mechanism had allowed an attacker to mint 40.650602 nBTC on Osmosis with no corresponding Bitcoin backing, compromising approximately 36% of allBTC's reserves. On-chain researcher Rarma traced the principal exploit activity to June 25, 2026, meaning the vulnerability went undetected for roughly 74 days before public disclosure. An emergency chain upgrade locked 22.65 BTC in the attacker-controlled address; a governance proposal to seize those funds and draw on the Osmosis community pool to cover the remaining ~17.19 BTC shortfall was launched on September 10, 2026, but had not been voted on as of the date of this report.

Connected Entities

1 entities · 10 linked investigations
Organizations
□Osmosis (allBTC / Nomic Bridge Double-Spend Exploit, September 2026)
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Trenton Richard Johnston·2Q2 2026 DeFi Record Hack Wave·0Luiz Carlos Capuci Jr.·0Alephium Bridge·18Bunni Protocol·28BitGrail·2Interpol Operation First Light 2026 — $123M Romance Scam Crypto Network·0
    Have evidence about Osmosis (allBTC / Nomic Bridge Double-Spend Exploit, September 2026)?

    Timeline(7 events)

    25 June 2026

    Principal exploit activity: attacker minted approximately 40.650602 nBTC on Osmosis through 25 identical IBC transfers in a single Nomic transaction, exploiting a double-spend flaw in Nomic's custom forwarding mechanism. The cost of the exploit was reportedly one satoshi.

    Protos; CryptoSlate (citing on-chain researcher Rarma)

    17 July 2026

    Second tranche of exploit activity: approximately 22.65060846 allBTC created using invalid nBTC. These funds remained unmoved in the attacker's address at the time of disclosure.

    CryptoSlate (citing on-chain researcher Rarma)

    6 September 2026

    Nomic chain produced its last Bitcoin checkpoint.

    CryptoTimes; Crypto Briefing

    7 September 2026

    Nomic chain halted. The halt prompted review of allBTC's backing composition, surfacing the 39.84 nBTC shortfall.

    CryptoTimes; CoinPaprika

    9 September 2026

    Osmosis publicly disclosed the exploit and froze allBTC minting, redemption, Nomic-related deposits, and withdrawals. Emergency chain upgrade v31.1.0 locked 22.65 BTC in the attacker's address.

    CryptoSlate; CryptoTimes; Crypto Briefing

    10 September 2026

    Osmosis published a governance forum post proposing to restore allBTC's 1:1 backing by seizing 22.65 BTC from the attacker's frozen address and drawing approximately 17.19 BTC from the Osmosis community pool.

    PANews; Protos

    14 September 2026

    Osmosis assetlists repository PR #3771 merged, updating nBTC and allBTC user-facing tooltips to reflect the exploit and halted redemption status. No on-chain governance proposal had been submitted as of this date.

    GitHub — osmosis-labs/assetlists PR #3771
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain10 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 10 of 13 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 9/14/2026, 11:34:45 PM

    last updated: 9/15/2026, 6:42:09 AM

    avoid.net — verified advice for a post-truth world