On September 9, the Osmosis decentralized exchange suspended minting, redemption, deposits, and withdrawals for its synthetic Bitcoin asset, alloyed BTC (allBTC), following an exploit on the Nomic blockchain. The incident was caused by a double-spend vulnerability in Nomic's custom forwarding mechanism, which allowed the creation of fraudulent vouchers that reached Osmosis via the IBC protocol.
Approximately 39.84 nBTC were compromised, representing about 36% of the total backing for allBTC on Osmosis and roughly 30% of the exchange's total BTC exposure. An emergency chain upgrade successfully locked 22.65 BTC in an address linked to the attacker, preventing further movement of these funds.
While trading of BTC in existing liquidity pools remains active, users cannot create new allBTC or redeem existing holdings. To resolve the shortfall, Osmosis plans to propose a governance vote to seize the frozen 22.65 BTC and use the community pool to cover the remaining gap to restore 1:1 backing.
The team expects to release a full incident report and a detailed recovery plan in the coming days. The specific timeline for restoring normal operations for minting and redemptions has not yet been specified.
