Nomic (nBTC forwarding double-spend) hack — June 2026
Incident facts
| Date of incident | (approximate) |
|---|---|
| Publicly disclosed | September 9, 2026 |
| Target type | Cross-chain bridge |
| Loss | $3,125,000Price at time of disclosure |
| Method | Contract logic errorA flaw in Nomic's custom forwarding mechanism allowed nBTC to be spent twice, and the resulting false vouchers were sent over IBC into Osmosis's allBTC basket against properly backed bitcoin |
| Chains | Other |
| Outcome | Unresolved |
What happened
Osmosis suspended its alloyed bitcoin, allBTC, on 9 September 2026 after finding that 39.84 of the nBTC in its backing basket had no bitcoin behind them. That was about 36% of the asset's backing, or roughly $3.1m at that day's price.
The fault was on Nomic, the Cosmos chain that issues nBTC as a bridged form of bitcoin. A flaw in its custom forwarding mechanism let the attacker spend the same nBTC twice and send the resulting false vouchers to Osmosis over IBC, where they entered the allBTC basket alongside properly backed bitcoin. Osmosis said its own contracts and the IBC protocol were not compromised.
The exploitation was not new. The on-chain researcher Rarma traced the principal minting to 25 June 2026 and the remaining activity to 17 July, more than two months before anyone disclosed it. The date recorded here comes from that tracing and should be read as approximate. Nomic stopped producing Bitcoin checkpoints on 6 September, appeared to halt the next day, and had published no statement by 9 September.
An emergency upgrade on Osmosis froze 22.65 allBTC that had been created during the exploit and never moved. Osmosis paused minting and redemption of allBTC along with all Nomic-related deposits and withdrawals, while trading in existing pools continued under elevated-risk warnings. It plans a governance proposal to seize the frozen coins and to use bitcoin held in its community pool to restore a one-to-one peg. Even if the full 22.65 is recovered, about 17.19 BTC would still be needed to fill the 39.84 BTC hole. Until governance acts, nothing is recorded as recovered.
No publisher has put a dollar figure on the loss. The amount recorded is this registry's conversion of 39.84 BTC at the CoinGecko daily price of about $78,450 on 9 September, the disclosure date, which gives about $3.13m. At the 25 June price it would have been about $2.4m. The DefiLlama dataset lists $3.15m.
Sources
- CryptoSlateSecondary · retrieved 2026-09-10
- The Crypto TimesSecondary · retrieved 2026-09-10
- Crypto BriefingSecondary · retrieved 2026-09-10
Changes to this entry
- Recorded the day after disclosure. No publisher has given a dollar figure, so the amount is this registry's conversion of 39.84 BTC at the CoinGecko daily price of about $78,450 on 9 September 2026, the disclosure date, and the valuation basis is marked accordingly. The incident date comes from one researcher's tracing and is marked approximate. 22.65 allBTC are frozen but not yet seized, so nothing is recorded as recovered until Osmosis governance acts.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Nomic (nBTC forwarding double-spend) hack — June 2026", iTokenly, accessed 2026-09-10, https://itokenly.com/hacks/nomic-nbtc-forwardinghttps://itokenly.com/hacks/nomic-nbtc-forwardingPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.