Osmosis Security Incident Exposes Shortfall in Bundled Bitcoin Token
Osmosis, a Cosmos-based decentralized exchange (DEX), has confirmed a security incident that affected its connected Nomic network. An attacker was able to double-spend Nomic's Bitcoin-backed asset, nBTC, and send false vouchers onto Osmosis.
Osmosis said the bug sat in a custom forwarding mechanism on Nomic, and that Osmosis contracts and the Inter-Blockchain Communication (IBC) protocol were not compromised. The exchange froze 22.65 BTC in the attacker's address after validators completed an emergency upgrade.
The security incident left a large share of Alloyed BTC, Osmosis's bundled Bitcoin token, without full reserve backing. Users have been warned to treat exposure as elevated, and the exchange has paused minting, redemptions, and Nomic-related deposits.