Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Nomic bridging vulnerability triggered an nBTC double spend incident, and Osmosis urgently froze assets to restore the hook.
An attacker used a forwarding mechanism vulnerability in the Nomic bridging protocol to double spend nBTC, creating 39.84 nBTC without real Bitcoin support. Subsequently, Osmosis passed an emergency verifier upgrade, freezing 22.65 BTC associated with the attacker's address and suspending casting, redemption and all Nomic-related deposit functions.
This exploit resulted in approximately 36% of the circulation of Osmosis's Alloyed BTC (allBTC) lacking real Bitcoin reserve support. Nomic, a bridging protocol that allows bitcoin to enter the Cosmos ecosystem, issues nBTC that is designed to be fully endorsed by real bitcoins held in reserves on a 1:1 basis.
Between September 7 and 8, attackers discovered a flaw in Nomic's custom forwarding mechanism and used the vulnerability to achieve double spending of nBTC, essentially forging fake Bitcoin certificates that never actually deposited funds. These fraudulent certificates flowed into Osmosis's Alloyed BTC contracts. It is a hybrid asset that combines Bitcoin tokens from multiple bridging protocols into one highly liquid token.
Osmosis pointed out in a statement: "The attacker successfully double spent Nomic's bitcoin-backed asset, nBTC, and sent false certificates to Osmosis." At the same time, it clarified that "Osmosis's smart contracts and cross-chain communications (IBC) protocols have not been compromised." In other words, the vulnerability lies in Nomic's bridging logic, not in Osmosis's own code or the extensive IBC messaging standards that connect Cosmos chains.
In response to the crisis, Osmosis froze 22.65 BTC associated with the attacker's address through an emergency validator upgrade and suspended minting, redemption and new Nomic deposits while the damage was being investigated. Trading in bitcoin-related assets in the existing liquidity pool remains active, but with warnings about increased risks. This exploit reduced the true endorsement rate of Alloyed BTC to approximately 64%, which means that approximately 36% of the current tokens in circulation lack the backing of Bitcoin.
Osmosis has proposed a governance vote to confiscate frozen bitcoins and community pool funds to restore the 1:1 pegging ratio. As of the time of writing, Osmosis and Nomic have not yet released a complete incident review report.
