Osmosis, the prominent decentralized exchange in the Cosmos ecosystem, suspended key operations for its synthetic Bitcoin asset on September 9 after an exploit on the Nomic blockchain allowed an attacker to double-spend nBTC. The exchange froze minting, redemption, deposits, and withdrawals for alloyed BTC (allBTC) while moving to contain the damage.
An emergency upgrade managed to lock 22.65 BTC in the attacker’s address before the funds could be moved. Approximately 39.84 nBTC were compromised in the incident, meaning more than a third of the asset backing that allBTC holders were counting on was suddenly in question.
What happened and how much is at stake
The exploit targeted a flaw in a custom forwarding mechanism on the Nomic chain, a Cosmos-based blockchain designed to bring Bitcoin into the broader interchain ecosystem. That flaw allowed false vouchers to be created through a double-spend of nBTC, which is essentially a wrapped representation of Bitcoin living on Nomic.
Those fraudulent vouchers then made their way to Osmosis via the Inter-Blockchain Communication (IBC) protocol. The IBC protocol itself wasn’t compromised, and Osmosis’s own systems weren’t breached directly. The vulnerability lived upstream, on Nomic’s side.
