Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves

Osmosis has frozen 22.65 BTC after a flaw in Nomic’s custom forwarding system allowed a double-spend that left the allBTC asset partly unbacked by Bitcoin.

allBTC is issued against a basket of Bitcoin variants held on Osmosis, including nBTC from the Nomic bridge. The official allBTC dashboard showed 110.57 allBTC in circulation and 39.84 nBTC in the basket at the reporting cutoff.

Osmosis said the nBTC was created from false vouchers, putting 36.03% of allBTC’s backing in question and leaving about 70.73 BTC-equivalent of other backing.

The statement also noted that neither its chain nor the Inter-Blockchain Communication protocol was compromised, and the bug was in Nomic’s forwarding logic.

SlowMist’s incident database also described the event as a Nomic bridge double-spend.

The public disclosure came more than two months after the apparent exploit activity. On-chain researcher Rarma traced the principal minting to June 25 and said 22.65060846 allBTC created during July 17 activity remained unmoved when the trace was published.

Nomic and allBTC inflows and outflows have been frozen, while allBTC minting and redemption are paused. Those restrictions block entry and exit through the affected functions while the backing gap remains unresolved.

Governance now carries the recovery of the Bitcoin balance

The frozen BTC has not been seized or returned to the basket. Osmosis said it plans to ask governance to confiscate the 22.65 BTC and use Bitcoin accumulated in the community pool to cover the remainder.

If governance recovers the full frozen amount, it would still need about 17.19 BTC to replace the 39.84 BTC impairment. No matching seizure or recapitalization measure appeared among the latest 20 on-chain proposals as of Sept. 9.

Osmosis governance administers the allBTC contract, while a 3-of-6 moderator subDAO can pause the pool or mark a constituent asset as corrupted. Nomic’s Bitcoin custody documentation separately says reserve disbursals require signatures representing more than 90% of its signatory set’s voting power.

Until enough valid backing is restored, allBTC holders remain collectively exposed because claims on the basket exceed its valid BTC-equivalent assets.

That does not establish a realized haircut for any holder, but redemption at full parity now depends on the governance decision and the size of any community-pool contribution.