Osmosis Took 74 Days To Discover A 40-BTC Nomic Exploit That Left Its Bitcoin-Backed Asset 36% Unbacked

An attacker minted 40.65 BTC worth of Nomic’s nBTC on June 25 without depositing any Bitcoin to back the tokens. It then took Osmosis — where the resulting shortfall left its allBTC reserves 36% unbacked — 74 days to discover the exploit.

Neither of the Cosmos-based projects appeared to detect or disclose the loss during that period. The exploit only came to light after the Nomic protocol was halted, prompting Osmosis to investigate its holdings and uncover the missing Bitcoin backing.

The incident also raises questions about the state of Nomic itself. The project’s X account has not posted since 2024, while its GitHub repository has reportedly seen no commits for roughly two years, suggesting the protocol may no longer be actively maintained.

The attacker combined two separate bugs to generate a transaction that “minted 40.650602 BTC of nBTC on Osmosis with no BTC behind it.”

For Osmosis, the damage could have been worse. The attacker left a significant portion of the proceeds untouched as allBTC, which the exchange froze earlier this week through an “emergency upgrade.” The exploiter did, however, manage to cash out roughly $1 million worth of the proceeds at the time by converting 671 ETH and sending it to Tornado Cash through Ethereum.

Osmosis now faces a roughly 40-BTC hole in the backing of its allBTC reserves. A proposal on the project’s governance forum outlines a plan to cover the shortfall, including seizing the 22.65 allBTC frozen in the attacker’s account, cancelling a pending liquidity redeployment of USDC.noble and withdrawing additional allBTC from the Community Pool.

The Nomic exploit is also putting the Cosmos ecosystem’s security and disclosure practices under scrutiny.

Osmosis, a decentralized exchange, and Nomic, a bridge, are both part of the wider Cosmos ecosystem, which has recently experienced a series of security incidents stemming from a separate vulnerability in a widely used Cosmos EVM module.

That episode also drew criticism over how the vulnerability was disclosed. Cosmos Labs came under fire after one affected project, KiiChain, described its loss as “avoidable,” arguing that publishing a critical security fix before notifying affected teams effectively “hands the vulnerability to anyone reading the commit.”

The Nomic incident presents a different but equally troubling problem. Rather than a vulnerability becoming public before affected projects could respond, an attacker appears to have exploited the flaw and left behind a hole in Bitcoin backing that remained undetected for more than two months.

That delay matters because the longer an exploit remains undiscovered, the more time an attacker has to move, convert or conceal stolen assets — and the harder it becomes for affected projects to determine the full scale of the damage.

For Osmosis, the immediate challenge is filling the missing Bitcoin backing and accounting for the assets that were recovered or moved. For the broader Cosmos ecosystem, the incident raises a more fundamental question: how quickly can projects detect a critical exploit once an attacker has already found it?