Key Takeaways
- • A bug in Nomic's IBC forwarding mechanism allowed an attacker to mint 39.84 unbacked nBTC on June 25, 2026, creating a 36% shortfall in the backing of Osmosis's Alloyed BTC basket—a critical collateralization failure that went undetected for 74 days.
- • The exploit required minimal resources to execute (one satoshi) and exploited a code flaw that duplicated a single Bitcoin deposit, making the second copy spendable as additional nBTC; this was the only instance of this vulnerability among 18 similar processes in the file.
- • Osmosis responded by immediately freezing deposits and withdrawals tied to Nomic and Alloyed BTC, then deployed an emergency validator update that locked 22.65 BTC remaining in the attacker's wallet, preventing further losses.
- • Osmosis governance is seeking approval to seize the frozen 22.65 BTC and tap its community pool to restore full backing to Alloyed BTC, addressing the ~36% collateralization gap created by the exploit.
- • The 74-day detection lag underscores operational and monitoring gaps in cross-chain DeFi infrastructure, particularly around real-time verification of asset backing in multi-protocol baskets.
Summary
On June 25, 2026, a software vulnerability in Nomic's custom IBC (Inter-Blockchain Communication) forwarding path enabled an attacker to mint 39.84 unbacked nBTC tokens. Critically, this 36% hole in the backing of Osmosis's Alloyed BTC basket remained undetected for 74 days until Osmosis disclosed the exploit this week and took emergency action to contain further damage.
The technical root cause, identified by independent researcher Rarma, stemmed from a code defect in Nomic's forwarding mechanism that accidentally created duplicate Bitcoin deposits. Specifically, the system processed the same Bitcoin deposit twice, rendering the second copy spendable as additional nBTC. Remarkably, this was the only instance of such duplication among 18 similar processes within the file, and the system failed to verify account ownership or control. The attack itself required negligible resources—just one satoshi—to execute, highlighting the severity of the underlying design flaw.
Upon discovery, Osmosis moved swiftly to contain the breach. The team immediately suspended deposits and withdrawals linked to Nomic and Alloyed BTC. Validators then pushed an emergency protocol update that froze 22.65 BTC still held in the attacker's wallet, preventing any additional fund transfers or exploitation. The 74-day delay between exploit and detection raises serious questions about monitoring and transparency mechanisms within the broader DeFi ecosystem, particularly for composite asset baskets spanning multiple protocols.
Osmosis is now seeking governance approval to seize the 22.65 BTC held in the attacker's wallet and deploy reserves from its community pool to fully restore Alloyed BTC's collateralization. The incident underscores material operational and audit risks in cross-chain DeFi infrastructure, where single points of failure in one protocol's code can cascade into systemic backing shortfalls affecting dependent platforms and user positions.
The technical root cause, identified by independent researcher Rarma, stemmed from a code defect in Nomic's forwarding mechanism that accidentally created duplicate Bitcoin deposits. Specifically, the system processed the same Bitcoin deposit twice, rendering the second copy spendable as additional nBTC. Remarkably, this was the only instance of such duplication among 18 similar processes within the file, and the system failed to verify account ownership or control. The attack itself required negligible resources—just one satoshi—to execute, highlighting the severity of the underlying design flaw.
Upon discovery, Osmosis moved swiftly to contain the breach. The team immediately suspended deposits and withdrawals linked to Nomic and Alloyed BTC. Validators then pushed an emergency protocol update that froze 22.65 BTC still held in the attacker's wallet, preventing any additional fund transfers or exploitation. The 74-day delay between exploit and detection raises serious questions about monitoring and transparency mechanisms within the broader DeFi ecosystem, particularly for composite asset baskets spanning multiple protocols.
Osmosis is now seeking governance approval to seize the 22.65 BTC held in the attacker's wallet and deploy reserves from its community pool to fully restore Alloyed BTC's collateralization. The incident underscores material operational and audit risks in cross-chain DeFi infrastructure, where single points of failure in one protocol's code can cascade into systemic backing shortfalls affecting dependent platforms and user positions.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.