Osmosis Bridge Exploit: 74-Day Delay in Discovery Leads to $77,834 Loss

Osmosis, a decentralized exchange, took 74 days to discover that an attacker had exploited a bug in its Nomic bridge protocol. The attack allowed the hacker to mint over 40 BTC worth of nBTC out of thin air on June 25.

The attacker used two separate bugs in the custom forwarding mechanism on Nomic to double-spend nBTC, allowing them to send false vouchers to Osmosis. This resulted in the creation of 40.650602 BTC of nBTC with no backing.

Although the hacker managed to cash out approximately $1 million worth of loot by sending 671 ETH to Tornado Cash via Ethereum, a significant portion of the stolen funds remained untouched as allBTC. Osmosis later froze these assets through an emergency upgrade.

Osmosis proposes filling the 40 BTC shortfall in allBTC backing by seizing 22.65 allBTC frozen in the attacker's account and cancelling a pending liquidity re-deployment of USDC.