Cabinet
Back to Technology Insights
2026.09.09

A Forwarding Bug on Nomic Allowed nBTC Double-Spending and Left About 36% of Osmosis allBTC Unbacked

A Forwarding Bug on Nomic Allowed nBTC Double-Spending and Left About 36% of Osmosis allBTC Unbacked

What happened

Per Osmosis's statement (2026-09-09, 09:48 UTC), a defect in Nomic's custom forwarding mechanism allowed multiple nBTC claims to be established against the same underlying value, and an attacker used it to produce unbacked vouchers. Those forged nBTC then arrived at Osmosis over IBC as ordinary, valid token transfers.

Osmosis's Alloyed BTC (allBTC) aggregates several bridged variants of bitcoin into one tradeable token. The figures reported from the official dashboard put allBTC in circulation at 110.57 against 39.84 nBTC in the basket — 36.03%, leaving roughly 70.73 BTC-equivalent of intact backing. Measured against the exchange's total BTC exposure it is said to be about 30%. The impaired 39.84 BTC-equivalent is valued near USD 3.15 million (about JPY 480 million at 152.27 JPY/USD, Google Finance, 2026-09-13), consistent with BTC near USD 77,715 on 2026-09-11.

The response came in two stages. First the moderation subDAO — a 3-of-6 body with authority over the allBTC contract that can pause the pool or flag a constituent asset as corrupted — froze inflows and outflows for both Nomic and allBTC. Then validators completed an emergency chain upgrade that quarantined 22.65 BTC at an address tied to the attacker. The Osmosis chain itself was never halted. Trading in existing liquidity pools continued, so holders can still swap, but minting and redemption are suspended.

Why "IBC was not compromised" is not reassurance

Osmosis states plainly that neither the Osmosis chain nor IBC was compromised, and that is technically correct. IBC correctly verified and carried a token transfer exactly as the source chain attested it. The problem is that the attestation itself — Nomic's claim that the transfer was authorised — was wrong.

This is the crux of cross-chain trust. Light-client schemes like IBC verify that the counterparty chain's consensus is operating correctly. What they do not verify is whether the application logic running on top of that consensus is correct. Nomic's validator set formed consensus normally; the forwarding logic above it permitted an invalid state transition. From IBC's point of view the packet was entirely legitimate.

So "IBC was not compromised" describes where the defect lives; it is not a conclusion about risk. For anyone accepting bridged assets, risk is always the product of messaging-layer security and the correctness of the issuing chain's application logic.

The shape is not new. On 2026-08-11 Osmosis paused minting and redemption for Alloyed XRP after an exploit on the tx XRPL bridge, likewise keeping pool trading live. This time the containment is narrower still: no chain restart, only the affected asset's flows frozen. And unlike July's USD 24.15 million AFX bridge drain, where validator signatures authorised an unauthorised withdrawal, this was not a signing failure but an accounting one — the same value supporting multiple claims.

What the basket design protected, and what it did not

Alloyed Assets carry static caps and change-rate limits per constituent so that one weak bridge cannot empty the basket. Here those limits partly worked. They did not stop invalid nBTC from entering, but they held the share near 36% and left roughly 70.73 BTC-equivalent of backing intact. That is why Osmosis can describe this as partial impairment rather than a total failure.

What the design did not protect matters more operationally. Redemption halts at the level of the asset. Even with 64% of the backing sound, once redemption of the single allBTC token is suspended, no holder can withdraw just the healthy portion of their position. Diversification lowers expected loss; it does not diversify availability. Anyone adopting a basket design needs to evaluate those two properties separately.

Generalised: the fault tolerance of a synthetic asset is measured not by what fraction of its constituents broke, but by what stops when one of them does. Here, issuance and redemption stopped while pool trading did not. That split was an Osmosis design decision, and other synthetic assets do not necessarily make the same one — under a design that halts trading as well, holders would have lost the exit entirely.

Pitfalls to watch

First, the invalid nBTC was minted earlier in 2026 and surfaced only when the exploit was disclosed in September. allBTC therefore traded with hidden gaps in its backing for weeks. Monitoring backing health by current balances cannot detect that latency; what is needed is reconciliation of issuance and accepted vouchers against the issuing chain's own state.

Second, a freeze is not compensation. The 22.65 BTC has merely been immobilised, not distributed to allBTC holders. Seizure requires an Osmosis governance vote, and at the time of reporting no corresponding proposal number was live on public dashboards. Even full recovery leaves the difference against 39.84 — roughly 17.19 BTC, about USD 1.34 million or JPY 200 million — to be covered from the community pool, which is also a vote.

Third, recoverability depends on design decisions on Nomic's side. Nomic's custody documentation states that reserve disbursals require signatures representing more than 90% of the voting power in its signatory set. That threshold exists for security, but during a recovery it works in the direction of slowing everything down.

Fourth, pool trading continues while redemption is suspended. An asset publicly known to be 36% unbacked can keep changing hands at its prior price inside liquidity pools, which means price and backing can stay decoupled for an extended period. Protocols accepting allBTC as collateral need to price that gap in.

[Technical Insights & Actions]

  1. In a basket-style synthetic asset, one broken constituent stops redemption for the whole thing. What was diversified was exposure, not availability. Static and change-rate limits capped the share but did not prevent invalid vouchers entering in the first place. [Product and risk management] This month, check the composition of each synthetic asset you hold or accept and whether impairment of one constituent halts redemption; where it does, treat the asset as if it were the single weakest constituent.
  2. A healthy messaging layer guarantees nothing about the correctness of the issuing chain's application logic. IBC and other light-client designs verify consensus validity, not the accounting that runs on top of it. [Integrators] Within two weeks, design monitoring that reconciles total issuance on the source chain against total received supply on your chain for each bridged asset, and set exposure caps on assets where that reconciliation is impossible.
  3. Having a freeze capability does not mean losses are made whole quickly. Between freeze, seizure and top-up sit a governance vote and, potentially, a high signing threshold on the source chain. "We can freeze it, so it's safe" ignores the time axis entirely. [Treasury and credit] When setting limits on bridged assets, score the procedure and expected number of days from freeze to actual restitution, not merely whether a freeze authority exists.

[Sources]

This article is a technical commentary based on publicly available information and is not investment advice.

Previous Articleether.fi Liquid's AtomicQueue.solve() Trusted a Caller-Supplied Solver, and Existing ERC-20 Allowances Were DrainedNext Article A Range-Proof Verification Cache Bug Let Liquid Network Mint Roughly 4,000 BTC of Unbacked L-BTC