Osmosis: bOSMO Redemption Vulnerability Affects 1,037 Accounts, 40,500 OSMO to Be Compensated

Odaily Planet Daily reports that Osmosis has identified a vulnerability in the redemption contract of bOSMO, a liquid staking token issued by Backbone Labs. Since April 2026, the contract has repeatedly counted OSMO staked by Backbone’s own validators during each redemption, causing redeeming users to receive approximately 50% more OSMO than they are entitled to, with the excess paid for by other bOSMO holders. To prevent further harm to other holders from additional redemptions from the community pool, a single transaction on October 10 redeemed approximately 776,000 bOSMO, withdrawing about 1,299,700 OSMO. The OSMO involved in this redemption is expected to be fully unbonded by October 24. Osmosis will compensate approximately 40,500 OSMO to 1,037 accounts that held bOSMO at the snapshot time, at a rate of 1.1174 OSMO per bOSMO prior to redemption; payments will be automatically distributed upon unbonding completion on October 24, with no action required from users. After the redemption, the asset backing of bOSMO has dropped significantly, and each bOSMO can now only be redeemed for approximately 0.06 OSMO via Backbone. Since the vulnerability remains unpatched, the market can still mint new bOSMO at a cost of approximately 0.039 OSMO each, causing pricing in some liquidity pools to significantly exceed their actual redemption value. Osmosis advises users not to purchase bOSMO or provide liquidity to related pools, and recommends existing liquidity providers withdraw their funds.