Decentralized exchange Osmosis has frozen assets equivalent to 22.65 bitcoins following an attack on the transaction processing mechanism of the Nomic network.
The incident created a backing deficit of approximately 36 percent for Alloyed BTC, known as allBTC, an Osmosis ecosystem token that combines multiple tokenized versions of bitcoin.
Team members at Osmosis stated that neither the exchange itself nor the Inter-Blockchain Communication protocol, known as IBC, was compromised during the security breach.
Osmosis functions as a major decentralized financial exchange within the Cosmos ecosystem, enabling automated trading across independent blockchain networks. To use bitcoin within these protocols, networks rely on wrapped tokens that represent bitcoin deposited into cross-chain bridge contracts.
How the Nomic transaction vulnerability occurred
Nomic allows bitcoin to be used across other blockchains through nBTC, a token intended to be backed by a matching amount of bitcoin deposited into its cross-chain bridge.
Within the Osmosis platform, nBTC forms part of the Alloyed BTC pool alongside other tokenized versions of bitcoin, allowing users to exchange the different variants at a one-to-one ratio.
According to Osmosis representatives, a flaw in the transaction processing system of Nomic permitted an attacker to double-spend nBTC tokens and transfer unbacked assets directly into Osmosis. The perpetrator then used allBTC to swap those unbacked tokens for other cryptocurrencies.
Exploit timeline and movement of stolen funds
Findings published by an anonymous researcher using the handle Rarma indicated that the primary attack occurred on June 25.
Rarma reported that the attacker generated approximately 40.65 nBTC and transferred the funds to Osmosis using 25 individual cross-chain transfers.
The perpetrator converted a portion of those tokens into USDC stablecoins before transferring the assets across the Axelar and Noble bridges to Ethereum, where they were converted into ether. In total, the unknown attacker removed assets equivalent to roughly 18 bitcoins using this method.
On July 17, the attacker converted the remaining 22.65 nBTC into allBTC and stored the tokens at an address on the Osmosis blockchain.
Shortfall calculations and community recovery plans
According to calculations by Rarma, approximately 110.57 allBTC were in circulation at the time of the investigation, compared to actual backing of 70.73 bitcoins, leaving a total shortfall of roughly 39.84 bitcoins.
The Osmosis team confirmed that 39.84 nBTC associated with the attack were held in the allBTC backing reserve without corresponding bitcoin backing.
Following the suspension of operations on Nomic, developers worked alongside network validators to complete an emergency upgrade that froze the assets stored at the attacker address.
Representatives of the decentralized exchange said they plan to put forward a governance proposal to vote on confiscating the frozen funds. They also proposed using bitcoins from the community pool treasury to cover the remaining deficit and fully restore collateral for allBTC holders.
Related judicial freezing of cryptocurrency assets
In a separate legal dispute over frozen digital assets, investment company Dominion Capital filed a lawsuit against cryptocurrency lender BlockFills, accusing the firm of misappropriating and illegally holding approximately $5 million in client crypto assets.
Pending the resolution of that lawsuit, the U.S. District Court for the Southern District of New York ordered the freezing of 70.6 BTC belonging to BlockFills.
