Osmosis has implemented a freeze on 22.65 BTC following the discovery of a flaw within Nomic’s custom forwarding system. The vulnerability allowed for a double-spend exploit, which resulted in the allBTC asset becoming partially unbacked by actual Bitcoin reserves.
The allBTC asset is backed by a diversified basket of Bitcoin variants on Osmosis, including nBTC sourced from the Nomic bridge. At the time of reporting, the official allBTC dashboard indicated 110.57 allBTC in circulation, supported by 39.84 nBTC within the reserve basket.
According to Osmosis, the nBTC in question was generated via fraudulent vouchers, compromising approximately 36.03% of the backing for allBTC and leaving roughly 70.73 BTC-equivalent in remaining valid backing.
The protocol clarified that neither the Osmosis chain nor the Inter-Blockchain Communication (IBC) protocol was breached; rather, the vulnerability was contained within Nomic’s specific forwarding logic.
The incident was also categorized as a Nomic bridge double-spend by SlowMist’s incident database.
This public disclosure follows a two-month delay since the initial exploit activity. On-chain researcher Rarma identified the primary minting event on June 25, noting that 22.65060846 allBTC created during the July 17 activity remained stationary at the time the trace was released.
Currently, Nomic and allBTC inflows and outflows are frozen, and allBTC minting and redemption processes have been suspended. These measures are intended to prevent further movement through the affected functions while the backing deficit is addressed.
Governance Tasked with Restoring Bitcoin Reserves
The frozen BTC has not yet been reclaimed or reintegrated into the reserve basket. Osmosis has announced plans to submit a governance proposal to confiscate the 22.65 BTC and utilize Bitcoin from the community pool to cover the remaining deficit.
Even if governance successfully recovers the entire frozen amount, a deficit of approximately 17.19 BTC would still exist to address the 39.84 BTC impairment. As of September 9, none of the 20 most recent on-chain proposals included a definitive seizure or recapitalization strategy.
The allBTC contract is managed by Osmosis governance, while a 3-of-6 moderator subDAO maintains the authority to pause the pool or flag constituent assets as corrupted. Separately, Nomic’s documentation specifies that reserve disbursements require signatures representing more than 90% of the signatory set’s voting power.
Until sufficient valid backing is restored, allBTC holders face collective exposure, as total claims on the basket currently exceed its valid BTC-equivalent assets.
While this does not represent a finalized loss for individual holders, the ability to redeem assets at full parity is now contingent upon governance outcomes and the scale of any community pool contributions.