Osmosis took 74 days to discover 40-BTC Nomic exploit

An attacker minted over 40 BTC worth of Nomic’s nBTC out of thin air on June 25. It took Osmosis, whose allBTC later turned out to be 36% unbacked, a whole 74 days to notice.

Neither of the Cosmos-based projects seemingly discovered nor disclosed the loss during that period. The exploit only came to light following a halt of the Nomic protocol, which prompted an investigation into its holdings by Osmosis.

Nomic itself appears not to be actively maintained; the project’s X account last posted in 2024 and its GitHub saw its last commit two years ago.

Read more: Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week

The exploiter combined two separate bugs to generate a transaction which “minted 40.650602 BTC of nBTC on Osmosis with no BTC behind it.”

Luckily for Osmosis, the attacker left a considerable chunk of the proceeds untouched as allBTC, which was frozen earlier this week through an “emergency upgrade.”

They did manage to cash out approximately $1 million (at the time) worth of the loot, though, by sending 671 ETH to Tornado Cash via Ethereum.

A post to the project’s governance forum details how Osmosis proposes filling the 40 BTC shortfall in allBTC backing. On top of seizing the 22.65 allBTC frozen in the attacker’s account, it suggests cancelling a “pending liquidity re-deployment” of USDC.noble and pulling additional allBTC from a Community Pool.

Read more: Cosmos Labs under fire over disclosure of bug affecting four blockchains

Disclosure lag in the Cosmos ecosystem

Both Osmosis (a decentralised exchange) and Nomic (a bridge) are part of the wider Cosmos ecosystem, which was recently hit by a string of incidents stemming from an unrelated bug in a widely used Cosmos EVM module.

While the timeline was considerably shorter than following the nBTC exploit, developers Cosmos Labs drew criticism for the manner in which it disclosed the bug.

One of the victim projects, KiiChain, branded its loss “avoidable,” adding that publishing a critical security fix before advising affected teams effectively “hands the vulnerability to anyone reading the commit.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.