Osmosis said an exploit in Nomic allowed 40.650602 nBTC to be issued without collateral and went undetected for 74 days, driving the collateral ratio of Bitcoin-linked asset allBTC down to 63.97% before the issue was identified during an asset review after the Nomic chain was halted on September 7.

According to Osmosis, the attack took place on June 25 and centered on a vulnerability in Nomic’s custom transfer feature. The recovery proposal said the unauthorized issuance was processed through 25 identical IBC transfers within a single Nomic transaction, allowing the attacker to send false vouchers by double-spending nBTC.

Osmosis said 39.839746 nBTC created through the attack was counted as collateral for allBTC, leaving a shortfall of about 39.84 BTC. That pushed allBTC’s collateral ratio to 63.97%, weakening the backing of the Bitcoin-linked asset inside the Osmosis ecosystem.

After the Nomic chain was halted on September 7, Osmosis said it identified the issue during an asset review. The protocol then used an emergency upgrade to freeze 22.650608 allBTC that remained in the attacker’s address. Osmosis said the attacker had already moved the remaining roughly 18 BTC out of Osmosis and converted it to Ethereum.

Osmosis has proposed recovering the frozen assets and adding Bitcoin to the community pool as part of a broader remediation plan. The protocol said both the final recovery amount and the timeline for resuming allBTC functionality remain subject to governance approval.

Why It Matters

The incident goes beyond a single exploit because it hit the integrity of a Bitcoin-backed asset rather than only draining a treasury or user wallet. For wrapped or bridged BTC products, confidence depends on collateral being verifiable, isolated, and redeemable under stress. A prolonged detection gap and a post-exploit collateral drop raise harder questions about monitoring, accounting, and emergency controls across connected chains.

It also highlights the structural risk in cross-chain systems where one network’s transfer logic can affect another protocol’s collateral base. For Cosmos-linked assets, the episode may sharpen scrutiny on IBC-linked issuance models, operational reviews, and how quickly exchanges and protocols can freeze or ring-fence compromised balances when an exploit crosses chain boundaries.