A bug in the Nomic bridge allowed an attacker to mint roughly 40.65 nBTC (Bitcoin vouchers) with no real Bitcoin backing them, and the fraudulent tokens sat undetected for 74 days before triggering an emergency freeze of Osmosis's allBTC basket asset on September 9, 2026. The exploit exposed a critical blind spot in how Cosmos-based bridges handle state verification, and it reveals why wrapped-asset designs can turn a single chain's bug into a multi-chain crisis.

What Happened to Osmosis's allBTC?

Nomic is a Cosmos-based blockchain designed specifically to bridge native Bitcoin into the Cosmos ecosystem by issuing nBTC, a token meant to represent a 1:1 claim on locked Bitcoin. Osmosis, the largest decentralized exchange (DEX) in Cosmos, pools nBTC together with other Bitcoin representations into a basket token called Alloyed BTC, or allBTC, to give traders one liquid synthetic Bitcoin instead of juggling several thinly-traded wrapped versions.

On June 25, 2026, an attacker bundled 25 separate Inter-Blockchain Communication (IBC) transfers into a single transaction and exploited a bug in Nomic's forwarding logic to mint roughly 40.65 nBTC that had no real Bitcoin backing. Those fraudulent vouchers flowed straight into Osmosis's allBTC basket and sat there for weeks, treated as legitimate collateral. Nothing looked wrong until Nomic suspended its own chain operations on September 7, exposing a mismatch between the nBTC Nomic could account for and the vouchers Osmosis had already accepted.

Osmosis went public on September 9, halting allBTC minting, redemptions, deposits, and withdrawals across the board. Validators pushed an emergency upgrade that froze 22.650608 allBTC sitting in the attacker's address. The total unbacked mint affected 39.84 nBTC, equal to about 36% of allBTC's Bitcoin backing, leaving the basket only 63.97% collateralized at the moment of discovery.

Why Did the Bug Go Undetected for Over Two Months?

The technical root cause lay in how Nomic processed bundled IBC forwarding messages. According to reporting, the attacker combined two separate bugs in Nomic's code: one in how the chain processes bundled IBC forwarding messages, and a second in how it verifies that each unit of nBTC corresponds to a unique, backed Bitcoin deposit. Stack enough sub-messages into a single transaction and the forwarding module apparently lost track of which deposits had already been counted, letting the same underlying claim get minted more than once.

The key insight is that Osmosis had no way to detect the fraud on its end because the vouchers arrived through IBC looking identical to legitimate ones. IBC, the Inter-Blockchain Communication protocol that powers transfers between Cosmos chains, carried the fraudulent messages faithfully without checking whether the Bitcoin behind those messages actually existed. This is the third time in 2026 that a wrapped-Bitcoin or bridge design has been undone by a state-tracking gap rather than a stolen private key, following incidents like the Liquid Network sidechain hack and the Allbridge forged-message exploit earlier in the year.

How Much Was Actually Lost?

The dollar figures depend on which portion of the exploit is counted. Validators managed to freeze 22.65 BTC tied to the attacker's address, worth close to $1.8 million at prevailing prices. That leaves roughly 17 BTC still missing, which the September 10 governance proposal wants to backfill from Osmosis's community pool. If none of the frozen funds are recovered, the full 39.84 BTC exposure would run closer to $3.1 million at Bitcoin's mid-September price band of roughly $76,000 to $79,000.

By 2026 cryptocurrency standards, the dollar amount is small, somewhere between $1.8 million in confirmed frozen funds and roughly $3.1 million in total exposure. The incident stayed well under 1% of the roughly $21.94 billion that bridges collectively hold in total value locked, keeping this firmly in the category of a contained incident rather than a systemic one.

How Did Osmosis and Nomic Respond?

Osmosis's playbook followed a now-familiar sequence for Cosmos incidents: halt first, communicate second, patch the ledger third. The chain froze allBTC activity within roughly 48 hours of Nomic's chain suspension. Validators then used an emergency software upgrade to lock the attacker-linked balance rather than waiting for a lengthy governance vote, a step that would be far harder to pull off on a permissionless EVM (Ethereum Virtual Machine) chain without a trusted multisig or pause function already built in.

The governance forum proposal filed on September 10 sets out two remaining steps: a future software upgrade to formally confiscate the frozen allBTC, and a community-pool draw to cover the residual gap so that allBTC returns to full 1:1 backing. As of publication, the proposal remained under discussion rather than a passed vote, meaning users still could not redeem allBTC at full value until the community formally signed off.

Why This Matters Beyond the Dollar Amount

The mechanics of this exploit matter more than the number itself. This is a story about how a bug in one chain's bridge logic can quietly drain trust from an entire basket asset built on top of it, and about why Cosmos's Inter-Blockchain Communication protocol, the plumbing that makes IBC transfers possible, keeps getting blamed for failures that live one layer up in the bridges that plug into it.

IBC has spent years marketing itself as the safer alternative to externally-verified bridges precisely because it does not rely on a small multisig committee to attest to transfers. This exploit does not contradict that pitch technically, since IBC's own message-passing worked exactly as designed, but it does show that the security of wrapped assets depends entirely on the quality of the bridge code that sits between the user and the underlying asset.

How to Protect Yourself From Bridge and Wrapped-Asset Risks

• Understand What You're Holding: Wrapped assets like allBTC are only as safe as the bridge code that backs them. A basket asset that pools multiple Bitcoin representations inherits the risk of every bridge feeding into it, not just one.
• Check the Collateralization Ratio: Before holding a significant amount of any wrapped or synthetic asset, verify that it is fully backed by the underlying collateral. A 36% shortfall like allBTC experienced means redemptions will be delayed or partial until governance votes to restore backing.
• Prefer Direct Custody Over Yield Products: Any service paying yield on Bitcoin is lending that Bitcoin to somebody else, which is how Liquid's users lost their money. Self-custody or regulated spot Bitcoin ETFs (Exchange-Traded Funds) eliminate the middleman risk that bridge exploits create.
• Monitor Chain Suspensions: When a bridge chain like Nomic suspends operations, it is a red flag that something is wrong with the collateral backing. Check governance forums and official announcements before the market does.

The incident landed at an awkward moment for Cosmos. Because Osmosis moved fast to isolate the damage to allBTC rather than the whole exchange, and because both Osmosis and outside reporting repeatedly stressed that IBC itself never broke, the incident did not produce the kind of market-wide flight seen after larger bridge failures like Wormhole or Ronin. Still, the episode underscores a persistent tension in cross-chain design: the protocol layer (IBC) can be perfectly secure, but the application layer (the bridge code) can fail silently for months.