Osmosis has suspended deposits, withdrawals, minting and redemptions for Alloyed BTC after a vulnerability in Nomic enabled an attacker to double-spend nBTC and send unbacked vouchers to Osmosis. The pause leaves existing liquidity pools tradable but prevents users from issuing or redeeming the composite asset while its backing is assessed.

The security failure affected 39.84 nBTC held within Alloyed BTC, representing roughly 36% of the asset’s backing. Osmosis and the Inter-Blockchain Communication (IBC) protocol were not compromised. The vulnerability was isolated to Nomic’s custom forwarding mechanism.

Emergency Upgrade Freezes 22.65 BTC

After detecting the discrepancy, Osmosis’ management subDAO halted Nomic and Alloyed BTC inflows and outflows. Validators then coordinated an emergency network upgrade that froze 22.65 BTC at an address controlled by the attacker.

Existing BTC liquidity pools remain tradable, but users cannot create new Alloyed BTC or redeem it through the normal backing mechanism. Osmosis had paused Alloyed BTC operations before publishing the more detailed breakdown of the Nomic exploit.

Alloyed BTC, or allBTC, combines multiple Bitcoin representations in a single Osmosis asset. These include native WBTC, Axelar-routed WBTC and cbBTC, Cosmos Hub-routed WBTC, and Nomic’s nBTC. Limits on each component are intended to restrict the extent to which the asset can depend on any individual bridge.

The incident differs from July’s $24.15 million AFX bridge drain, in which validator signatures authorized an unauthorized USDC withdrawal. Nomic’s failure instead allowed the same underlying value to support multiple nBTC claims before forged vouchers entered Osmosis through IBC.

Governance Could Address a Remaining 17.19 BTC Shortfall

Osmosis plans to ask governance to seize the frozen 22.65 BTC and use Bitcoin held in the community pool to cover the remaining shortfall. That makes the recovery plan dependent on governance approval rather than solely on validator action or a technical upgrade.

If the frozen amount is recovered, roughly 17.19 BTC would remain to be used for recapitalization, based on the 39.84 nBTC exposure identified by Osmosis. The proposed combination would restore Alloyed BTC to full backing before normal minting and redemptions resume.

The incident follows another failure involving a Bitcoin representation rather than Bitcoin itself. Liquid Network recently recovered 3,400 BTC after nearly 4,000 BTC left its federation reserve when unbacked L-BTC entered an authorized peg-out route.

Nomic Exposure Had Been Set to Increase

The Nomic exposure is notable because Osmosis had been considering increasing the permitted share of nBTC in Alloyed BTC. A July governance discussion proposed raising nBTC’s static limit from 35% to 60% after its share reached roughly 33%.

The proposal said Nomic demand had outgrown the existing cap. One community participant, however, questioned the bridge’s limited public development activity and specifically raised the risk of a future compromise.

Osmosis has not resumed Alloyed BTC deposits, withdrawals, minting or redemptions. The next recovery step is a governance proposal covering the seizure of the 22.65 frozen BTC and the use of community-pool Bitcoin to restore the asset’s backing.