Bitcoin Fund Lost 36% of Its Backing, Nobody Noticed for 74 Days

A software flaw in Nomic’s custom IBC forwarding path allowed an attacker to mint unbacked nBTC, creating a 36% shortfall in the backing of Osmosis’s Alloyed BTC basket. The exploit occurred on June 25 and remained undetected for 74 days.

Bug Details and Impact

The flaw caused 39.84 nBTC to be minted without corresponding BTC, representing roughly 36% of the Alloyed BTC backing. The unbacked tokens were deposited into Osmosis’s Alloyed BTC pool.

Osmosis Response

Upon discovery, Osmosis halted deposits and withdrawals involving Nomic and Alloyed BTC. An emergency update with validators locked 22.65 BTC that were held in the attacker’s wallet. Osmosis plans to propose seizing these assets through governance and use community pool BTC to restore full backing.

Research Findings

Independent researcher “Rarma” identified that Nomic’s code duplicated a bitcoin deposit, creating an extra spendable nBTC. The duplication occurred in one of 18 similar processes, and the code lacked verification of the receiving account. The attack cost only one satoshi.

Takeaway

The incident highlights the reliance of wrapped or tokenized Bitcoin on the correctness of custom minting code on other chains.