The allBTC token on Osmosis has lost 36% of its collateral due to a Nomic network exploit, prompting emergency measures from developers.
The collateral backing the Alloyed BTC (allBTC) token on the decentralized exchange Osmosis has experienced a significant setback, with approximately 36% of its value rendered unsecured due to an exploit on the Nomic network involving the nBTC token. The incident was confirmed by the Osmosis project team.
We recently discovered an exploit on the Nomic chain that allowed an attacker to double-spend nBTC, leading to the issuance of false vouchers on Osmosis. Importantly, neither Osmosis nor the Inter-Blockchain Communication (IBC) protocol was compromised, as the issue originated from a flaw in Nomic's forwarding mechanism.
ā Osmosis š§Ŗ (@osmosis) September 9, 2026
Exploit Overview
Nomic facilitates cross-chain Bitcoin operations via the nBTC token, which is typically backed by Bitcoin deposits in a bridging protocol. On Osmosis, nBTC provides collateral for allBTC alongside other tokenized Bitcoin variants, allowing for a 1:1 exchange.
The exploit enabled the attacker to double-spend nBTC, transferring counterfeit assets to Osmosis and subsequently exchanging them for real tokens. According to researcher Rarma, the attack unfolded on June 25, when the perpetrator generated around 40.65 nBTC and sent it to Osmosis through 25 transfers across networks.
allBTC on @osmosiszone is currently 63.97% backed, with 110.57 allBTC in circulation against 70.73 BTC in actual collateral. The 39.84 BTC deficit is due to nBTC issued by @nomicbtc, which has been paused since September 7.
ā Rarma (@Rarma_) September 8, 2026
Subsequent exchanges converted some of the acquired tokens into WBTC and USDC, which were then moved through Axelar and Noble bridges to Ethereum, ultimately being converted into ETH. Rarma traced around 671.75 ETH to the attacker's final address, with a portion later laundered through the Tornado Cash mixer.
In total, assets worth approximately 18 BTC were extracted, while the remaining 22.65 nBTC was converted into allBTC and retained at an Osmosis address.
Response and Recovery Plans
Rarma's analysis indicated that there were 110.57 allBTC in circulation, with a backing of only 70.73 BTC, resulting in an approximate shortfall of 39.84 BTC. Following the attack, all operations on Nomic and the allBTC pool were suspended as of September 7.
The Osmosis team confirmed that the 39.84 nBTC involved in the attack was part of the collateral for allBTC. Security teams took immediate action to halt transactions via Nomic and all allBTC operations. They also collaborated with validators to implement an emergency update that froze assets at the attacker's address, estimated at 22.65 BTC.
Developers are now preparing to propose a vote for the confiscation of these frozen assets and plan to use Bitcoin from the community fund to restore the allBTC collateral fully. Notably, on September 7, a separate incident involved the withdrawal of $320 million in Bitcoin from the Liquid Network by individuals claiming to be white-hat hackers, who later returned 3,400 BTC the following day.
