Verify a decision

{"actor":"system:backfill","investigation_id":"14aa179b-7594-4ae0-8858-5ee069efca15","kind":"publish","page_slug":"osmosis-allbtc-nomic-bridge-double-spend-exploit-september-2026","published_at":"2026-09-14T23:34:55.807Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Osmosis (allBTC / Nomic Bridge Double-Spend Exploit, September 2026)","sections":[{"content":"Osmosis, a decentralized exchange built on the Cosmos ecosystem, operates an 'alloyed' Bitcoin token (allBTC) that pools multiple wrapped-Bitcoin variants — including nBTC issued by the Nomic bridge — into a single composite reserve. On September 9, 2026, Osmosis validators executed an emergency freeze of allBTC minting, redemption, Nomic-related deposits, and withdrawals after an investigation revealed that 39.84 nBTC held inside the allBTC transmuter had no Bitcoin backing. The shortfall represented approximately 36.03% of allBTC's total backing. Trading in existing liquidity pools was not halted. Osmosis stated explicitly that neither its own chain nor the Inter-Blockchain Communication (IBC) protocol was compromised, and attributed the root cause to a bug in Nomic's upstream forwarding logic.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Osmosis Freezes 22.65 BTC After Nomic Forwarding Bug Compromises Bitcoin Reserves — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/"},{"credibility":2,"name":"Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/"},{"credibility":2,"name":"Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/"}]},{"content":"According to reporting by Protos and on-chain analysis attributed to researcher Rarma, the attacker exploited two combined bugs in Nomic's custom transaction-forwarding mechanism. The vulnerability allowed the same Bitcoin deposit to be processed more than once within a single Nomic transaction, effectively creating false vouchers that were then transferred to Osmosis via IBC and accepted as valid nBTC collateral. On June 25, 2026, the attacker generated approximately 40.650602 nBTC through 25 identical IBC transfers within a single Nomic transaction, at a reported cost of only one satoshi. Rarma's analysis described Nomic's system as having created the same bitcoin deposit twice within one of 18 similar processes in the relevant forwarding code. A second tranche of activity, generating 22.65060846 allBTC, was recorded on July 17, 2026; those funds remained unmoved at the time Rarma published the trace. The invalid nBTC passed validation checks and entered the allBTC transmuter pool where it continued to be counted as backing for 74 days. Osmosis confirmed the flaw was upstream in Nomic's forwarding logic, not in IBC or Osmosis contracts.","heading":"Technical Details of the Exploit","severity":"critical","sources":[{"credibility":2,"name":"Osmosis took 74 days to discover 40-BTC Nomic exploit — Protos","type":"news_article","url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"credibility":2,"name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked — CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/"},{"credibility":2,"name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC — Blockfence","type":"research","url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/"}]},{"content":"At the time of public disclosure, 110.57 allBTC was in circulation, backed by 70.73 BTC of valid reserves. The 39.84 nBTC fraudulently minted by the attacker created a shortfall valued at approximately $3.15 million, or roughly 36.03% of allBTC's total backing. An emergency chain upgrade (v31.1.0) locked 22.65 BTC in the attacker-controlled address before those funds could be moved. Approximately $1 million worth of proceeds — reported as 671 ETH — was allegedly transferred to Tornado Cash via Ethereum before the freeze, according to Protos citing Rarma's trace. Approximately 18 BTC of the total 40.65 BTC minted was reportedly laundered in this manner and cannot be directly recovered. Even if governance successfully seizes the frozen 22.65 BTC, a shortfall of approximately 17.19 BTC would remain, requiring the Osmosis community pool to supply additional Bitcoin to restore 1:1 backing.","heading":"Financial Impact","severity":"critical","sources":[{"credibility":2,"name":"Osmosis took 74 days to discover 40-BTC Nomic exploit — Protos","type":"news_article","url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"credibility":2,"name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC — Blockfence","type":"research","url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/"},{"credibility":2,"name":"Cosmos Ecosystem DEX Osmosis Proposes to Restore Alloyed BTC Peg via Community Pool and Seizing Attacker Assets — PANews","type":"news_article","url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144"}]},{"content":"A significant concern raised by multiple outlets is the 74-day gap between the earliest identified exploit activity (June 25, 2026) and public disclosure (September 9, 2026). According to reporting by Protos and Bitcoin.com News, the shortfall went undetected until the Nomic chain itself halted on September 7, 2026, at which point a review of allBTC's backing exposed the gap. Nomic had ceased producing Bitcoin checkpoints as of September 6, 2026. On-chain researcher Rarma identified the June 25 and July 17 activity retrospectively after the halt triggered the investigation. The incident has drawn comparison to prior Cosmos ecosystem disclosure concerns; Protos noted it follows criticism of how Cosmos Labs handled an unrelated critical multi-chain bug. As of the time of reporting, Nomic's official X/Twitter account had last posted in 2024 and its GitHub repository's final commit predated the exploit by approximately two years, raising questions about the project's active maintenance at the time the vulnerability was exploited.","heading":"Disclosure Lag and Monitoring Concerns","severity":"high","sources":[{"credibility":2,"name":"Osmosis took 74 days to discover 40-BTC Nomic exploit — Protos","type":"news_article","url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"credibility":2,"name":"Bitcoin Fund Lost 36% of Its Backing, Nobody Noticed for 74 Days — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/bitcoin-fund-lost-36-of-its-backing-nobody-noticed-for-74-days/"},{"credibility":3,"name":"Nomic Flaw Erased 36% Backing From Osmosis Bitcoin Fund for 74 Days — Gokhshtein Media","type":"news_article","url":"https://gokhshtein.com/news/2026-09-10-nomic-flaw-erased-36-backing-from-osmosis-bitcoin-fund-for"}]},{"content":"On-chain analysis attributed to researcher Rarma traced the following movement pathway for minted nBTC: Osmosis liquidity pool 1868, Axelar, Noble, and Ethereum. Approximately 671 ETH, reportedly equivalent to roughly $1 million at the time of the transfer, was allegedly sent to Tornado Cash via an Ethereum address. The Ethereum address associated with the attacker has been reported as 0x8f36fd9ffc0a8ca373aa7a4787292536a489d2b5. These allegations are based on on-chain tracing by Rarma and secondary reporting; no law enforcement or regulatory body has confirmed the attribution as of the date of this report. The identity of the attacker is unknown. The 22.65060846 allBTC created on July 17 remained unmoved in the attacker's address at the time the trace was published, enabling the emergency freeze.","heading":"Attacker Activity and Fund Movements","severity":"high","sources":[{"credibility":2,"name":"Osmosis took 74 days to discover 40-BTC Nomic exploit — Protos","type":"news_article","url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"credibility":2,"name":"Osmosis Freezes 22.65 BTC After Nomic Forwarding Bug Compromises Bitcoin Reserves — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/"}]},{"content":"Osmosis validators responded on September 9, 2026, by halting allBTC minting, redemption, and all Nomic-related deposits and withdrawals. The emergency chain upgrade v31.1.0 was deployed to freeze the 22.65 BTC in the attacker's address. Osmosis stated that neither the IBC protocol nor its own chain was compromised, characterizing the flaw as upstream in Nomic's forwarding logic. On September 10, 2026, Osmosis published a governance forum post proposing a two-step recovery plan: (1) a governance vote to seize the 22.65 BTC frozen in the attacker's address; and (2) a draw on accumulated BTC reserves in the Osmosis community pool to cover the remaining approximately 17.19 BTC shortfall and restore 1:1 backing. The proposal also included cancelling a pending USDC.noble liquidity redeployment as part of the funding mechanism. As of September 14, 2026, no on-chain governance proposal had been formally submitted, and the governance forum post remained in the discussion phase. Osmosis publicly warned users to avoid unofficial recovery pages and phishing sites, directing users only to the official Osmosis X account and documentation. Nomic had not issued a public statement on the incident as of the time of reporting.","heading":"Osmosis and Nomic Response","severity":"medium","sources":[{"credibility":2,"name":"Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/"},{"credibility":2,"name":"Cosmos Ecosystem DEX Osmosis Proposes to Restore Alloyed BTC Peg via Community Pool and Seizing Attacker Assets — PANews","type":"news_article","url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144"},{"credibility":1,"name":"fix(osmosis-1): update BTC and nBTC tooltips for the Nomic exploit — GitHub PR #3771","type":"official","url":"https://github.com/osmosis-labs/assetlists/pull/3771"}]},{"content":"This incident is unrelated to the separately reported Drift Protocol hack, which has been linked to the DPRK-affiliated Lazarus Group and involved different assets, protocols, and attack vectors. The Osmosis allBTC / Nomic double-spend exploit involves a bridge-layer forwarding vulnerability on the Nomic chain and affected only the nBTC component of allBTC's backing. No connection between the Nomic exploit and any nation-state threat actor has been alleged in any source reviewed for this report.","heading":"Scope Clarification: Distinct from Drift Protocol Hack","severity":"low","sources":[{"credibility":3,"name":"AllBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend — eGamers.io","type":"news_article","url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/"}]},{"content":"As of September 14, 2026, allBTC minting, redemption, Nomic deposits, and withdrawals remain paused. The governance vote to seize attacker funds and authorize community pool disbursements had not been submitted on-chain. Approximately 17.19 BTC of the shortfall remains unaccounted for even if the frozen 22.65 BTC is successfully recovered. The Nomic chain remains halted with no Bitcoin checkpoints since September 6, 2026, and the Nomic project appears to lack active development. Full redemption at 1:1 parity is contingent on governance approval and the practical availability of community pool reserves. Until those votes pass and funds are deployed, allBTC holders face a partial backing shortfall. The Osmosis assetlists repository was updated via PR #3771 (merged September 14, 2026) to add user-facing warnings about the nBTC and allBTC status.","heading":"Ongoing Risks and Unresolved Status","severity":"high","sources":[{"credibility":2,"name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked — CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/"},{"credibility":1,"name":"fix(osmosis-1): update BTC and nBTC tooltips for the Nomic exploit — GitHub PR #3771","type":"official","url":"https://github.com/osmosis-labs/assetlists/pull/3771"},{"credibility":3,"name":"Osmosis allBTC: Check Bridged Bitcoin Backing Now — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/osmosis-allbtc-backing-check/"}]}],"sources_used":[{"credibility":2,"name":"Osmosis Freezes 22.65 BTC After Nomic Forwarding Bug Compromises Bitcoin Reserves — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/"},{"credibility":2,"name":"Osmosis took 74 days to discover 40-BTC Nomic exploit — Protos","type":"news_article","url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"credibility":2,"name":"Nomic Double-Spend Leaves a Third of Osmosis Bitcoin Unbacked — CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/"},{"credibility":2,"name":"Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/"},{"credibility":2,"name":"Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/osmosis-nomic-nbtc-exploit-freezes-btc/"},{"credibility":2,"name":"Nomic nBTC Exploit Creates $3.15M Hole in Osmosis Alloyed BTC — Blockfence","type":"research","url":"https://blockfence.io/nomic-nbtc-exploit-creates-3-15m-hole-in-osmosis-alloyed-btc/"},{"credibility":2,"name":"Cosmos Ecosystem DEX Osmosis Proposes to Restore Alloyed BTC Peg via Community Pool and Seizing Attacker Assets — PANews","type":"news_article","url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144"},{"credibility":2,"name":"Bitcoin Fund Lost 36% of Its Backing, Nobody Noticed for 74 Days — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/bitcoin-fund-lost-36-of-its-backing-nobody-noticed-for-74-days/"},{"credibility":3,"name":"AllBTC's Backing Cracks: Osmosis Freezes 22.65 BTC Over Nomic Bridge Double-Spend — eGamers.io","type":"news_article","url":"https://egamers.io/allbtcs-backing-cracks-osmosis-freezes-22-65-btc-over-nomic-bridge-double-spend/"},{"credibility":3,"name":"Nomic Flaw Erased 36% Backing From Osmosis Bitcoin Fund for 74 Days — Gokhshtein Media","type":"news_article","url":"https://gokhshtein.com/news/2026-09-10-nomic-flaw-erased-36-backing-from-osmosis-bitcoin-fund-for"},{"credibility":3,"name":"Osmosis allBTC: Check Bridged Bitcoin Backing Now — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/osmosis-allbtc-backing-check/"},{"credibility":1,"name":"fix(osmosis-1): update BTC and nBTC tooltips for the Nomic exploit — GitHub PR #3771 (osmosis-labs/assetlists)","type":"official","url":"https://github.com/osmosis-labs/assetlists/pull/3771"},{"credibility":3,"name":"Osmosis Pauses Alloyed BTC After Nomic Double-Spend Exploit — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/osmosis-pauses-alloyed-btc-after-nomic-double-spend-exploit/"}],"summary":"On September 9, 2026, the Cosmos-based DEX Osmosis froze minting, redemption, deposits, and withdrawals for its alloyed Bitcoin token (allBTC) after discovering that a double-spend flaw in the Nomic chain's custom BTC-forwarding mechanism had allowed an attacker to mint 40.650602 nBTC on Osmosis with no corresponding Bitcoin backing, compromising approximately 36% of allBTC's reserves. On-chain researcher Rarma traced the principal exploit activity to June 25, 2026, meaning the vulnerability went undetected for roughly 74 days before public disclosure. An emergency chain upgrade locked 22.65 BTC in the attacker-controlled address; a governance proposal to seize those funds and draw on the Osmosis community pool to cover the remaining ~17.19 BTC shortfall was launched on September 10, 2026, but had not been voted on as of the date of this report.","timeline":[{"date":"2026-06-25","event":"Principal exploit activity: attacker minted approximately 40.650602 nBTC on Osmosis through 25 identical IBC transfers in a single Nomic transaction, exploiting a double-spend flaw in Nomic's custom forwarding mechanism. The cost of the exploit was reportedly one satoshi.","source":"Protos; CryptoSlate (citing on-chain researcher Rarma)","source_url":"https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/"},{"date":"2026-07-17","event":"Second tranche of exploit activity: approximately 22.65060846 allBTC created using invalid nBTC. These funds remained unmoved in the attacker's address at the time of disclosure.","source":"CryptoSlate (citing on-chain researcher Rarma)","source_url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/"},{"date":"2026-09-06","event":"Nomic chain produced its last Bitcoin checkpoint.","source":"CryptoTimes; Crypto Briefing","source_url":"https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/"},{"date":"2026-09-07","event":"Nomic chain halted. The halt prompted review of allBTC's backing composition, surfacing the 39.84 nBTC shortfall.","source":"CryptoTimes; CoinPaprika","source_url":"https://coinpaprika.com/news/nomic-double-spend-leaves-third-osmosis/"},{"date":"2026-09-09","event":"Osmosis publicly disclosed the exploit and froze allBTC minting, redemption, Nomic-related deposits, and withdrawals. Emergency chain upgrade v31.1.0 locked 22.65 BTC in the attacker's address.","source":"CryptoSlate; CryptoTimes; Crypto Briefing","source_url":"https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/"},{"date":"2026-09-10","event":"Osmosis published a governance forum post proposing to restore allBTC's 1:1 backing by seizing 22.65 BTC from the attacker's frozen address and drawing approximately 17.19 BTC from the Osmosis community pool.","source":"PANews; Protos","source_url":"https://panews.io/articles/01a08b2f-14a8-7469-afbe-a60a6f6a1144"},{"date":"2026-09-14","event":"Osmosis assetlists repository PR #3771 merged, updating nBTC and allBTC user-facing tooltips to reflect the exploit and halted redemption status. No on-chain governance proposal had been submitted as of this date.","source":"GitHub — osmosis-labs/assetlists PR #3771","source_url":"https://github.com/osmosis-labs/assetlists/pull/3771"}]},"v":1}