Nomic Chain nBTC Double-Spend → Osmosis Alloyed BTC Shortfall — $3.15M

On September 9, 2026, Osmosis disclosed that an exploit on Nomic — a Cosmos-based chain bridging Bitcoin into the interchain ecosystem via a custom transaction-forwarding mechanism — allowed an attacker to double-spend nBTC and send falsified vouchers to Osmosis via IBC. Neither Osmosis nor the IBC protocol itself was compromised; the vulnerability sat entirely upstream on Nomic's custom forwarding code. Approximately 39.84 nBTC (about 36% of Alloyed BTC's backing, roughly 30% of Osmosis's total BTC exposure) was affected. Osmosis froze all allBTC minting, redemption, deposits and withdrawals, and performed an emergency validator upgrade that successfully froze 22.65 BTC at the attacker's address before further funds could move — leaving a residual shortfall of approximately 17.19 BTC uncovered. Osmosis proposed a two-part remedy: a governance vote to formally seize the frozen 22.65 BTC, and use of the community pool's accumulated BTC to cover the remaining gap and restore full 1:1 backing. As of September 20, 2026 (11 days after disclosure), that governance vote had still not been held; the proposal remained in community discussion stage only, with no confiscation or collateral replenishment completed.