Approximately 36% of the collateral backing the Alloyed BTC (allBTC) token on the decentralized exchange Osmosis has been rendered unsecured due to nBTC that emerged from a breach on the Nomic network. This was reported by the project team.

Recently, we became aware of an exploit on the Nomic chain. The exploit allowed the attacker to double-spend nBTC, allowing them to send false vouchers to Osmosis. Osmosis and IBC were not compromised, as the bug was in a custom forwarding mechanism on Nomic.

39.84 nBTC of the…

— Osmosis 🧪 (@osmosis) September 9, 2026

According to the developers, the vulnerability was located in the mechanism that redirects Nomic transactions. Both Osmosis and the Inter-Blockchain Communication (IBC) protocol remained unaffected.

Details of the Attack

Nomic facilitates the use of Bitcoin across other blockchains through the nBTC token. Under normal circumstances, this token is backed by coins deposited in a bridge.

On Osmosis, nBTC serves as collateral for allBTC along with other tokenized versions of Bitcoin. This mechanism pools various asset types together, allowing for a 1:1 exchange.

The flaw in Nomic enabled the attacker to double-spend nBTC and transmit counterfeit coins to Osmosis. Through the allBTC pool, they exchanged these tokens for other assets.

A researcher known as Rarma provided an analysis of the operations, stating that the primary attack occurred on June 25, when the perpetrator created approximately 40.65 nBTC and sent them to Osmosis via 25 inter-network transfers.

allBTC on @osmosiszone is 63.97% backed. There are 110.57094432 allBTC in circulation against 70.73128010 BTC of real collateral. The 39.83966422 BTC gap is nBTC issued by @nomicbtc, which has been halted since 7 September.

The full trace follows, with sources for each step.… pic.twitter.com/38grqTDIG8

— Rarma (@Rarma_) September 8, 2026

Subsequently, they exchanged part of the acquired tokens for WBTC and USDC. These funds then moved through Axelar and Noble bridges into Ethereum, where they were converted into ETH.

Rarma traced approximately 671.75 ETH to the final address, with 671.1 ETH later funneled into the Tornado Cash mixer.

In total, the attacker exchanged and withdrew assets amounting to around 18 BTC. The remaining 22.65 nBTC was converted to allBTC on July 17 and kept at an address on Osmosis, according to the researcher.

Plans for Collateral Recovery

As per Rarma's calculations at the time of the analysis, there were about 110.57 allBTC in circulation with real backing of 70.73 BTC, resulting in a shortfall of approximately 39.84 BTC.

The expert also noted that operations on Nomic and the allBTC pool were halted on September 7.

The Osmosis team confirmed that 39.84 nBTC linked to the attack were part of the allBTC collateral. Security management groups suspended transactions through Nomic, along with all allBTC deposit and redemption operations.

In collaboration with validators, developers executed an emergency update to freeze the assets at the attacker's address, estimated by Osmosis at 22.65 BTC; Rarma's analysis cites the same balance in allBTC.

Developers now plan to present a proposal to vote on the confiscation of the frozen funds. To cover the remaining shortfall, they propose utilizing Bitcoin from the community fund to fully restore the allBTC backing.

It is worth noting that on September 7, unknown individuals withdrew Bitcoin worth $320 million from the Liquid Network, claiming to be white-hat hackers. The following day, they returned 3,400 BTC.