Approximately 36% of the collateral for the Alloyed BTC (allBTC) token on the decentralized exchange Osmosis became unsecured due to nBTC resulting from a breach of the Nomic network. The project team reported this incident.
Recently, we became aware of an exploit on the Nomic chain. The exploit allowed the attacker to double-spend nBTC, allowing them to send false vouchers to Osmosis. Osmosis and IBC were not compromised, as the bug was in a custom forwarding mechanism on Nomic.
39.84 nBTC of the…
— Osmosis 🧪 (@osmosis) September 9, 2026
According to the developers, the vulnerability was in the Nomic transaction forwarding mechanism. Osmosis and the Inter-Blockchain Communication (IBC) protocol were not affected.
How the Attack Occurred
Nomic allows the use of Bitcoin on other blockchains through the nBTC token. Under normal circumstances, it is backed by coins deposited in a bridge.
On Osmosis, nBTC is part of the collateral for allBTC, alongside other tokenized versions of the leading cryptocurrency. This mechanism combines different asset variants into a common pool, allowing them to be exchanged at a 1:1 ratio.
A flaw in Nomic enabled the attacker to double-spend nBTC and send fake coins to Osmosis. Through the allBTC pool, these tokens were exchanged for other assets.
Researcher Rarma published an analysis of the operations. According to him, the main attack occurred on June 25, when the attacker created about 40.65 nBTC and sent them to Osmosis through 25 inter-network transfers.
allBTC on @osmosiszone is 63.97% backed. There are 110.57094432 allBTC in circulation against 70.73128010 BTC of real collateral. The 39.83966422 BTC gap is nBTC issued by @nomicbtc, which has been halted since 7 September.
The full trace follows, with sources for each step.… pic.twitter.com/38grqTDIG8
— Rarma (@Rarma_) September 8, 2026
The attacker then exchanged part of the tokens for WBTC and USDC. Through the Axelar and Noble bridges, the funds reached Ethereum, where they were exchanged for ETH.
Rarma traced approximately 671.75 ETH to a final address and a subsequent transfer of 671.1 ETH to the Tornado Cash mixer.
In total, the attacker exchanged and withdrew assets worth about 18 BTC. The remaining 22.65 nBTC were converted to allBTC on July 17 and kept at an address in Osmosis, according to the researcher.
Plans for Collateral Restoration
According to Rarma’s calculations at the time of publication, there were about 110.57 allBTC in circulation with real collateral of 70.73 BTC, resulting in a shortfall of approximately 39.84 BTC.
The expert also noted that Nomic and allBTC pool operations were halted on September 7.
The Osmosis team confirmed that 39.84 nBTC related to the attack are part of the allBTC collateral. Security teams have suspended deposits and withdrawals via Nomic, as well as allBTC minting and redemption operations.
Together with validators, developers conducted an emergency update to freeze assets at the attacker’s address. Osmosis estimated this amount at 22.65 BTC; Rarma’s analysis indicated the same balance in allBTC.
Developers now plan to propose a vote on seizing the frozen funds. They suggest covering the remaining shortfall with Bitcoin from the community fund to fully restore allBTC collateral.
Earlier, on September 7, unknown individuals withdrew Bitcoin worth $320 million from the Liquid Network. The recipients identified themselves as white hat hackers. The next day, they returned 3,400 BTC.
