Osmosis halted minting and redemptions for its alloyed BTC product on Sept. 9 after a double-spend exploit on the Nomic chain compromised 39.84 nBTC, roughly 36 percent of the asset's backing. An emergency upgrade locked 22.65 BTC in the attacker's address, with governance approval and community pool funds planned to restore full collateralization.
Osmosis froze 22.65 BTC on Sept. 9 after a Nomic chain exploit double-spent 39.84 nBTC backing its alloyed BTC product.
The attack exploited a flaw in Nomic's custom forwarding mechanism, allowing the attacker to send fraudulent vouchers to Osmosis through the Inter-Blockchain Communication protocol, according to blockchain commentator @WuBlockchain, who first flagged the incident on X. The IBC protocol itself was not compromised, and Osmosis's own systems were not breached directly — the vulnerability sat upstream on Nomic's side.
The 39.84 nBTC affected represents roughly 36 percent of alloyed BTC's total backing on Osmosis and approximately 30 percent of the exchange's total BTC exposure. Osmosis pushed through an emergency chain upgrade that locked the stolen funds in an address linked to the attacker, preventing further extraction. Trading of BTC in existing liquidity pools has continued, but no new allBTC can be minted and existing holdings cannot be redeemed until the situation is resolved.
Osmosis plans to propose a governance vote to seize the 22.65 BTC currently frozen in the attacker's address, according to the exchange. In the Cosmos ecosystem, governance proposals can authorize on-chain actions if enough token holders vote in favor. The team also intends to tap its community pool to cover the gap between the frozen BTC and the total amount compromised, aiming to restore the 1:1 backing of alloyed BTC. A full incident report and detailed recovery plan are expected in the coming days.
The exploit follows a pattern of cross-chain bridge failures across the broader crypto sector. In August, Cronos rolled back nearly two hours of transaction history to reverse approximately $111.2 million tied to an exploit of lending protocol Tectonic, erasing 10,961 blocks. Maya Protocol also halted its network in August after an attacker exploited six software flaws and took approximately $1.65 million in crypto assets. These incidents show how custom bridge infrastructure — the bespoke forwarding mechanisms and messaging layers bolted onto established protocols — often harbors vulnerabilities that standardized code has already been hardened against.
For Osmosis users holding allBTC, the immediate question is whether the governance proposal to seize the frozen BTC will pass and how quickly community pool funds can cover the remaining shortfall. The incident also raises broader concerns about the security of Bitcoin-wrapped assets in the Cosmos ecosystem, where a single bridge compromise can threaten the collateral integrity of an entire synthetic asset class.
This article is for informational purposes only and does not constitute investment advice.
