Osmosis detected 40 BTC Nomic exploit after 74-day delay

On June 25, a hacker created more than 40 BTC in nBTC from Nomic without any backing. Osmosis, which later found its allBTC was 36% unbacked, took 74 days to detect the incident.

During those 74 days, neither Cosmos project appeared to have found or reported the loss. The exploit was only revealed after the Nomic protocol was paused, leading Osmosis to examine its assets.

Nomic does not seem to be under active development; its X account has not posted since 2024 and its GitHub repository's most recent commit dates back two years.

Recently, we became aware of an exploit on the Nomic chain. The exploit allowed the attacker to double-spend nBTC, allowing them to send false vouchers to Osmosis. Osmosis and IBC were not compromised, as the bug was in a custom forwarding mechanism on Nomic.

39.84 nBTC of the…
— Osmosis (@osmosis) September 9, 2026

The attacker used two distinct flaws to create a transaction that 'minted 40.650602 BTC of nBTC on Osmosis with no BTC behind it.'

Fortunately for Osmosis, the exploiter did not move a large portion of the funds, which remained as allBTC and was frozen this week via an 'emergency upgrade.'

The attacker still converted roughly $1 million of the stolen assets at that time, sending 671 ETH to Tornado Cash via Ethereum.

An Osmosis governance forum post outlines a plan to cover the 40 BTC gap in allBTC reserves. Besides confiscating the 22.65 allBTC frozen in the attacker's wallet, the proposal calls for canceling a 'pending liquidity re-deployment' of USDC.noble and taking extra allBTC from a Community Pool.

Disclosure lag in the Cosmos ecosystem

Osmosis, a decentralized exchange, and Nomic, a bridge, both belong to the Cosmos ecosystem. That ecosystem recently experienced a series of incidents linked to a separate flaw in a popular Cosmos EVM module.

Though the response time was much faster than in the nBTC case, Cosmos Labs faced criticism over how it revealed the bug.

KiiChain, one of the affected projects, called its loss 'avoidable,' saying that releasing a critical security patch without notifying impacted teams first essentially 'hands the vulnerability to anyone reading the commit.'