The vulnerability was in Nomic’s transaction processing mechanism. The exchange and the IBC cross-chain protocol were not compromised, assured the Osmosis team.
Nomic enables the use of Bitcoin on other blockchains through nBTC — a token that must be backed by an equivalent amount of Bitcoin deposited into the bridge. On Osmosis, nBTC is part of Alloyed BTC (allBTC) alongside other tokenized versions of the first cryptocurrency. They are combined into a single pool and can be exchanged at a 1:1 ratio.
The Nomic vulnerability allowed the attacker to spend nBTC multiple times and send tokens to Osmosis without adequate collateral. Through allBTC, he then exchanged them for other assets.
An anonymous researcher with the handle Rarma established that the main attack occurred on June 25. According to his findings, the hacker created approximately 40.65 nBTC and transferred them to Osmosis through 25 cross-chain transactions. Part of the tokens was exchanged for the stablecoin USDC, then moved via the Axelar and Noble bridges to Ethereum and converted into ether. In total, the unknown actor withdrew assets equivalent to approximately 18 bitcoins through this method.
The remaining 22.65 nBTC were converted by the hacker into allBTC and stored at an address on Osmosis on July 17. According to Rarma’s calculations, at the time of the investigation, approximately 110.57 allBTC were in circulation, backed by only 70.73 actual bitcoins, resulting in a shortfall of roughly 39.84 bitcoins.
The Osmosis team confirmed that 39.84 nBTC linked to the attack were held as collateral for allBTC without adequate backing by the underlying cryptocurrency. Following the suspension of operations, Nomic developers, in collaboration with validators, executed an emergency network upgrade and froze the attacker’s assets. Representatives from the DeFi exchange stated their intent to propose a vote on the withdrawal of the locked funds. The remaining shortfall is proposed to be covered by Bitcoin from the community fund to fully restore allBTC collateralization.
Previously, investment firm Dominion Capital filed a lawsuit against crypto lender BlockFills, accusing it of misappropriating and unlawfully withholding approximately $5 million in client crypto assets. During the proceedings, the U.S. District Court for the Southern District of New York froze 70.6 BTC owned by BlockFills.