Osmosis discovered 40-BTC Nomic exploit after 74-day delay
An attacker minted 40.650602 BTC of nBTC on Osmosis with no backing on June 25. Osmosis did not discover the exploit until 74 days later, after Nomic halted. The breach left 36% of Osmosis allBTC reserves unbacked.
An attacker exploited bugs in the Nomic chain to mint 40.650602 BTC of nBTC on Osmosis with no Bitcoin backing it, according to Protos reporting. The exploit occurred on June 25. Osmosis did not discover it until 74 days later, after Nomic halted operations.
The breach left 36% of Osmosis allBTC reserves unbacked, Protos reports. Two separate bugs on the Nomic chain combined to enable the false transaction; the Osmosis and IBC protocols themselves were not compromised, per Protos. The bug existed in a custom forwarding mechanism on Nomic.
The attacker minted 39.84 nBTC in the exploit and held 22.65 allBTC in the account when it was frozen. The attacker cashed out roughly $1 million worth of the loot by converting 671 ETH to Tornado Cash via Ethereum, according to Protos.
Osmosis proposed filling the 40 BTC shortfall in allBTC backing through three steps: seizing the 22.65 allBTC frozen in the attacker's account, cancelling a pending liquidity re-deployment of USDC.noble, and pulling additional allBTC from a Community Pool, Protos reports.
Neither Osmosis nor Nomic discovered or disclosed the loss during the 74-day period, per Protos. Nomic's X account last posted in 2024 and its GitHub saw its last commit two years ago, Protos reports, raising questions about the protocol's ongoing maintenance status.
The discovery came after Nomic halted, which prompted Osmosis to investigate its holdings.
Osmosis detected a solvency breach affecting 40+ BTC only after the Nomic protocol halted, revealing 36% of its cross-chain BTC reserves had no actual BTC backing them.
The detection delay and the scale of unbacking expose gaps in how Cosmos ecosystem protocols monitor reserve integrity. The outcome of Osmosis's proposed reserve-filling mechanism and whether the $1 million in converted funds can be recovered will determine how much actual loss materializes from the breach.
Ranked, source-checked, and verified by the desk's independent review pass.