Osmosis Pauses Alloyed BTC After Nomic Double-Spend Exploit

Osmosis has suspended deposits, withdrawals, minting and redemptions for Alloyed BTC after a vulnerability on Nomic allowed an attacker to double-spend nBTC and send unbacked vouchers into Osmosis.

The Nomic security failure affected 39.84 nBTC held inside Alloyed BTC, representing roughly 36% of the asset’s backing. Osmosis and the Inter-Blockchain Communication protocol were not compromised, with the vulnerability isolated to Nomic’s custom forwarding mechanism.

Emergency Upgrade Freezes 22.65 BTC

Osmosis’ management subDAO halted Nomic and Alloyed BTC inflows and outflows after detecting the discrepancy, while validators coordinated an emergency network upgrade that froze 22.65 BTC at an address controlled by the attacker.

Existing BTC liquidity pools remain tradable, but users cannot currently create new Alloyed BTC or redeem it through the normal backing mechanism. Osmosis had already paused Alloyed BTC operations before releasing the more detailed breakdown of the Nomic exploit.

Alloyed BTC, or allBTC, combines several Bitcoin representations behind a single Osmosis asset, including native WBTC, Axelar-routed WBTC and cbBTC, Cosmos Hub-routed WBTC and Nomic’s nBTC. Individual composition limits are intended to restrict how much of the alloy can depend on any single bridge.

The mechanism differs from July’s $24.15 million AFX bridge drain, where validator signatures authorized an unauthorized USDC withdrawal. Nomic’s failure instead allowed the same underlying value to support multiple nBTC claims before forged vouchers reached Osmosis through IBC.

Governance Could Cover Remaining 17.19 BTC Gap

Osmosis plans to ask governance to seize the frozen 22.65 BTC and use Bitcoin already held in the community pool to cover the remaining shortfall.

Recovering the frozen amount would leave roughly 17.19 BTC to recapitalize, based on the 39.84 nBTC exposure identified by Osmosis. The proposed combination would restore Alloyed BTC to full backing before normal minting and redemption resume.

The incident follows another failure involving a Bitcoin representation rather than Bitcoin itself. Liquid Network recently recovered 3,400 BTC after nearly 4,000 BTC left its federation reserve when unbacked L-BTC entered an authorized peg-out route.

nBTC Exposure Was Already Set to Increase

The Nomic exposure is notable because Osmosis had been considering increasing nBTC’s permitted share of Alloyed BTC.

A July governance discussion proposed raising nBTC’s static limit from 35% to 60% after its share reached roughly 33%. The proposal argued that Nomic demand had outgrown the existing cap, while one community participant questioned the bridge’s limited public development activity and specifically raised the risk of a future compromise.

Osmosis has not resumed Alloyed BTC deposits, withdrawals, minting or redemptions. The next recovery step is a governance proposal covering seizure of the 22.65 frozen BTC and use of community-pool Bitcoin to restore the asset’s backing.

The post Osmosis Pauses Alloyed BTC After Nomic Double-Spend Exploit appeared first on Crypto Adventure.