A Bitcoin bridge exploit that most of the crypto market didn’t even notice as it happened is now reshaping how the Cosmos ecosystem talks about wrapped BTC. On September 9, 2026, Osmosis froze minting, redemptions, deposits and withdrawals for its synthetic Bitcoin asset, allBTC, after discovering that a bug in the Nomic bridge had let an attacker mint tens of Bitcoin worth of fake collateral back in June. The twist: the exploit sat undetected for 74 days before anyone noticed the hole in the books.
The dollar figure is small by 2026 cryptocurrency standards, somewhere between $1.8 million in confirmed frozen funds and roughly $3.1 million in total exposure. But the mechanics matter more than the number. This is a story about how a bug in one chain’s bridge logic can quietly drain trust from an entire basket asset built on top of it, and about why Cosmos’s Inter-Blockchain Communication protocol, the plumbing that makes IBC transfers possible, keeps getting blamed for failures that live one layer up in the bridges that plug into it.
What Happened: Nomic’s nBTC Bug Freezes Osmosis allBTC
Nomic is a Cosmos-based chain purpose-built to bridge native Bitcoin into the Cosmos ecosystem, issuing a token called nBTC as a 1:1 voucher for BTC locked on its side. Osmosis, the largest decentralized exchange in Cosmos, pools nBTC together with other Bitcoin representations into a basket token called Alloyed BTC, or allBTC, meant to give traders one liquid synthetic BTC instead of juggling several thinly-traded wrapped versions.
That basket design is exactly what turned a Nomic-side bug into an Osmosis-side crisis. According to Osmosis’s own public statement, relayed by ForkLog, “the exploit allowed the attacker to double-spend nBTC, allowing them to send false vouchers to Osmosis,” while stressing that “Osmosis and IBC were not compromised, as the bug was in a custom forwarding mechanism on Nomic.” In other words, the fraudulent tokens traveled through IBC like any legitimate transfer. IBC just carried the message faithfully. It never checked whether the BTC behind that message actually existed.
Timeline: From a Silent June Exploit to a September Panic
The exploit itself happened on June 25, 2026, when an attacker bundled 25 separate IBC transfers into a single transaction and used Nomic’s forwarding logic to mint roughly 40.65 nBTC that had no real Bitcoin backing it, according to Cryptonomist. Those fraudulent vouchers flowed straight into Osmosis’s allBTC basket and sat there for weeks, treated as legitimate collateral.
Nothing looked wrong until Nomic suspended its own chain operations on September 7, a move that exposed a mismatch between the nBTC Nomic could account for and the vouchers Osmosis had already accepted. Osmosis went public on September 9, halting allBTC activity across the board, and validators pushed an emergency upgrade, v31.1.0, that froze 22.650608 allBTC sitting in the attacker’s address. A day later, on September 10, the Osmosis governance forum posted a formal proposal titled “Alloyed BTC: Restore backing after the nBTC incident,” laying out a plan to seize the frozen funds and cover the remaining gap with BTC from the protocol’s community pool.
The Technical Root Cause: A Forwarding Bug, Not an IBC Failure
Cryptonomist’s reporting says the attacker combined two separate bugs in Nomic’s code: one in how the chain processes bundled IBC forwarding messages, and a second in how it verifies that each unit of nBTC corresponds to a unique, backed Bitcoin deposit. Stack enough sub-messages into a single transaction and the forwarding module apparently lost track of which deposits had already been counted, letting the same underlying claim get minted more than once.
The pattern below is a simplified illustration of the failure class, not Nomic’s actual source code, which has not been published in full:
// Illustrative pseudocode of the failure pattern
function forward_ibc_batch(deposits[]) {
for (d of deposits) {
// BUG: balance check happens per-message,
// not against a single locked-deposit ledger entry
if (has_pending_credit(d.sender)) {
mint_nbtc(d.sender, d.amount); // can fire more than once
// missing: mark underlying BTC deposit as consumed
}
}
}Whatever the exact code path, the effect is well documented: a single BTC deposit generated multiple valid-looking mint events, and Osmosis had no way to detect the fraud on its end because the vouchers arrived through IBC looking identical to legitimate ones. This is the third time in 2026 that a wrapped-BTC or bridge design has been undone by a state-tracking gap rather than a stolen private key, following incidents like the Liquid Network sidechain hack and the Allbridge forged-message exploit earlier in the year.
The Numbers: How Much Was Actually Lost
Multiple outlets converge on the same core figures. The unbacked mint totaled 40.650602 nBTC. Once Osmosis totaled up the damage, it found 39.84 nBTC affected, equal to about 36% of allBTC’s Bitcoin backing, leaving the basket only 63.97% collateralized at the moment of discovery, per CryptoBriefing’s account carried on TradingView.
Of that shortfall, validators managed to freeze 22.65 BTC tied to the attacker’s address, worth close to $1.8 million at prevailing prices, according to a Coin Bureau alert cited in the same coverage. That leaves roughly 17 BTC still missing, which the September 10 governance proposal wants to backfill from Osmosis’s community pool. If none of the frozen funds are recovered, the full 39.84 BTC exposure would run closer to $3.1 million at BTC’s mid-September price band of roughly $76,000 to $79,000.
Osmosis and Nomic’s Emergency Response
Osmosis’s playbook followed a now-familiar sequence for Cosmos incidents: halt first, communicate second, patch the ledger third. The chain froze allBTC minting, redemption, deposits and withdrawals within roughly 48 hours of Nomic’s chain suspension. Validators then used an emergency software upgrade to lock the attacker-linked balance rather than waiting for a lengthy governance vote, a step that would be far harder to pull off on a permissionless EVM chain without a trusted multisig or pause function already built in.
The governance forum proposal filed on September 10 sets out two remaining steps: a future software upgrade to formally confiscate the frozen allBTC, and a community-pool draw to cover the residual gap so that allBTC returns to full 1:1 backing. As of publication the proposal remained under discussion rather than a passed vote, meaning users still can’t redeem allBTC at full value until the community formally signs off. Nomic, for its part, has stayed quieter in public statements, but its chain suspension on September 7 is what forced the issue into the open in the first place.
Market Reaction: Cosmos DeFi Under the Microscope
Because Osmosis moved fast to isolate the damage to allBTC rather than the whole exchange, and because both Osmosis and outside reporting repeatedly stressed that IBC itself never broke, the incident didn’t produce the kind of market-wide flight seen after larger bridge failures like Wormhole or Ronin. The dollar amount involved, well under 1% of the roughly $21.94 billion that bridges collectively hold in total value locked according to Altfins data cited in Shattered’s own Q2 2026 exploit tracking, kept this firmly in the category of a contained incident rather than a systemic one.
Still, the episode lands at an awkward moment for Cosmos. IBC has spent years marketing itself as the safer alternative to externally-verified bridges precisely because it doesn’t rely on a small multisig committee to attest to transfers. This exploit doesn’t contradict that pitch technically, since IBC’s own message-passing worked exactly as designed, but it does show that the security of any IBC-connected asset is only as strong as the weakest chain feeding into it. A basket token like allBTC inherits risk from every constituent bridge, whether or not the basket’s own code has a single flaw.
Historical Context: Bridges Have Always Been Crypto’s Weak Link
Cross-chain bridges have produced some of the largest single losses in crypto history, and the Nomic incident is a reminder that scale doesn’t determine whether a bridge failure makes headlines. The table below lines up the major bridge hacks of the last five years against this month’s Cosmos incident.
| Bridge | Date | Amount Lost | Root Cause |
|---|---|---|---|
| Poly Network | August 2021 | ~$611M | Privileged contract call abuse |
| Wormhole | February 2022 | ~$326M | Signature verification bypass on Solana |
| Ronin (Axie Infinity) | March 2022 | ~$625M | 5-of-9 validator keys compromised |
| Harmony Horizon | June 2022 | ~$100M | 2-of-5 multisig keys compromised |
| Nomad | August 2022 | ~$190M | Blank trusted-root initialization bug |
| Multichain (Anyswap) | July 2023 | ~$126M | Centralized operator/MPC key compromise |
| Orbit Chain | January 2024 | ~$82M | Compromised validator infrastructure |
| Nomic / Osmosis allBTC | June-September 2026 | ~$1.8M frozen (~$3.1M exposure) | Forwarding-logic double-spend of nBTC |
Those seven pre-2026 incidents alone add up to more than $2 billion in losses, according to figures compiled by StakingWatch’s bridge risk tracker and corroborated by Spark’s cross-chain research team, plus Shattered’s own bridge security testing coverage. What’s changed since 2022 is the attack surface, not the risk. DeepStrike’s 2026 Web3 security research found that classic bridge mint-and-burn exploits fell from 73% of DeFi protocol losses in 2022 to just 3% in 2025, but the underlying cross-chain trust problem didn’t disappear. It moved into messaging layers, verifier configurations and, as the Nomic case shows, basket-asset designs that quietly aggregate risk from multiple bridges into one token.
Wrapped Bitcoin Landscape in 2026: Who Holds the Risk
Nomic’s nBTC and Osmosis’s allBTC are minor players next to the two dominant wrapped-BTC brands. As of September 15, 2026, MetaMask’s price data put Wrapped Bitcoin’s (WBTC) market cap at $8,857,218,329, with Coinbase’s cbBTC close behind at $7,528,869,641. Both figures fluctuate daily with BTC’s own price, which sat in the $76,000 to $79,000 range through mid-September.
| Wrapped BTC / Bridge Asset | Approx. Market Cap or Pool Size (Sept 2026) | Custody Model |
|---|---|---|
| WBTC (BitGo custody) | ~$8.86B – $9.9B | Centralized custodian, merchant-minted |
| cbBTC (Coinbase) | ~$7.5B – $7.8B | Coinbase custody, exchange-minted |
| THORChain BTC liquidity | ~2,200 BTC equivalent pooled | Decentralized validator network, no wrapped token |
| Nomic nBTC / Osmosis allBTC | ~40 BTC affected in this incident | Cosmos chain bridge + IBC basket token |
The contrast matters for how much attention each design gets. WBTC and cbBTC dwarf Nomic’s nBTC in size, which means their custodial failure points, BitGo and Coinbase respectively, get audited far more aggressively by the market. THORChain skips wrapped tokens altogether, routing native BTC liquidity through its validator network instead, an approach that trades custodial risk for exposure to THORChain’s own historical hack record. Nomic and Osmosis represent a third model: decentralized bridge plus basket token, which spreads risk across constituents but also means a bug in any one constituent bridge degrades the whole basket, exactly what happened here.
Competitive Comparison: Basket Tokens vs Single-Custodian Wrapped BTC
The core design trade-off on display is diversification versus attack surface. A single-custodian token like WBTC has one point of failure, BitGo’s custody operation, but that one point is well capitalized, insured to a degree, and watched closely because so much value sits on top of it. Osmosis’s allBTC deliberately spreads BTC exposure across several bridges so no single one dominates, which sounds safer on paper. In practice it means allBTC’s security is only as good as its weakest link, and Osmosis itself has no way to independently verify what’s happening inside a partner chain like Nomic until something breaks.
THORChain’s model avoids wrapped tokens entirely by using a decentralized validator network to swap native assets directly, which removes the “unbacked voucher” failure mode seen here but introduces its own validator-key and liquidity-pool risks, the same category of risk that hit Ronin and Harmony Horizon in 2022. There is no version of cross-chain Bitcoin exposure in 2026 that eliminates trust assumptions. Each design just moves the trust somewhere else, whether that’s a custodian, a basket of bridges, or a validator set.
Why allBTC’s Basket Design Made This Worse
Basket tokens exist to solve a real liquidity problem. Instead of traders splitting volume across half a dozen thin BTC wrapper markets, they get one deep, tradable token. The downside surfaced clearly in September: because allBTC pools multiple bridge-issued BTC representations together, a hidden shortfall in just one of them, nBTC, silently degraded the entire basket’s backing without any visible warning sign for holders. Nobody trading allBTC on September 8 could have known that more than a third of its collateral was already compromised.
That opacity is the real lesson here, arguably bigger than the dollar loss. Proof-of-reserve style, real-time attestations for basket assets like allBTC would have flagged the shortfall the moment it happened on June 25, rather than 74 days later when Nomic’s own chain hiccup forced the issue into view.
The Bigger Picture: 2026’s Bridge Hack Tally
Zoom out and the Nomic incident fits a pattern that’s been building all year. TRM Labs’ H1 2026 crypto crime data, covering January through June, recorded 207 hacking incidents, a record high, but total losses of about $972 million, down roughly 57% from the $2.3 billion stolen in the same period of 2025. Incident counts more than doubled while dollar losses fell, meaning attackers are hitting more targets for smaller individual paydays.
Bridges keep punching above their weight in that data. PeckShield tracked eight separate bridge-related hacks in 2026 draining $328.6 million by May alone, against bridges’ collective $21.94 billion in total value locked, a wildly disproportionate share given how small a slice of overall DeFi TVL bridges represent. DeepStrike’s research goes further, finding that infrastructure compromise, spanning bridges, validators and message relays, caused 76% of H1 2026 crypto-hack losses while accounting for only about 15% of total incidents. TRM’s broader 2026 Crypto Crime Report also found that bridge-related fund movement by threat actors grew 66% year over year, even as mixer usage fell 37%, suggesting bridges have become the laundering route of choice as well as an attack target. That mirrors the pattern Shattered found in DeFi hack data earlier this year, where credential and key theft, not code bugs, drove the majority of dollar losses, and it lines up with the tripling of DeFi price-manipulation exploits tracked separately in 2026.
Analyst Predictions for Bridge Security Through 2027
Security researchers tracking this trend line expect it to continue rather than reverse. Here are five predictions grounded in current 2026 research:
- Bridges remain the top infrastructure target through 2027 until finality-based, multi-verifier checks become the default rather than the exception, a pattern flagged in Shattered’s own Q2 2026 exploit tracking.
- Key and credential compromise, not smart-contract bugs, will keep driving the largest single incidents, continuing the shift DeepStrike documented as classic bridge exploits fell from 73% of DeFi losses in 2022 to 3% in 2025.
- Basket and aggregator tokens like allBTC will face pressure to publish real-time, on-chain proof-of-reserve data after this incident, rather than relying on periodic audits.
- Capital continues rotating toward non-custodial, non-wrapped liquidity designs. HOGE’s 2026 bridge research estimates roughly $15 billion has already migrated toward these “verify, don’t trust” architectures this year.
- Cross-chain messaging dependency keeps growing regardless of the risk: DataIntelo’s market research projects more than 70% of DeFi protocols holding over $10 million in TVL will depend on at least one cross-chain messaging protocol by 2027.
What This Means for Cosmos and IBC’s Reputation
Cosmos has long pitched IBC as a structurally safer alternative to bridges that rely on small external validator committees, since IBC verifies transfers using each chain’s own light client rather than trusting a third party. That pitch survives this incident technically. IBC did exactly what it was built to do, faithfully relaying messages between Nomic and Osmosis. The problem is that “faithfully relaying a fraudulent message” produces the same result as a compromised bridge from the user’s point of view: money that isn’t really there.
For Cosmos builders, the takeaway is uncomfortable but simple. IBC’s security guarantees only cover the transport layer. Every application built on top, from Nomic’s Bitcoin peg to Osmosis’s basket tokens, still needs its own independent auditing and real-time verification, because IBC was never designed to check whether the assets being described in a message actually exist.
What Users and Developers Should Watch Next
The immediate thing to track is whether the September 10 Osmosis governance proposal passes and whether the community-pool BTC draw fully restores allBTC to 1:1 backing. Until that vote clears, allBTC redemptions carry residual risk that the basket is still short by roughly 17 BTC. Developers building on Nomic or integrating nBTC elsewhere should also watch for a public post-mortem detailing the exact forwarding-logic fix, since the two-bug combination described by Cryptonomist suggests the underlying code may need a broader audit, not a single patch.
More broadly, expect other basket-asset protocols across Cosmos and beyond to face questions about how quickly they’d catch a similar silent shortfall. Seventy-four days is a long time for a supposedly transparent, on-chain system to carry a hidden 36% collateral gap without anyone noticing.
Frequently Asked Questions
What is Nomic and how does it connect Bitcoin to Cosmos?
Nomic is a Cosmos-based blockchain designed to bridge native Bitcoin into the Cosmos ecosystem. Users lock BTC and receive nBTC, a token meant to represent that Bitcoin 1:1, which can then move across Cosmos chains via IBC.
What exactly happened in the Nomic bridge exploit?
An attacker exploited a forwarding-logic bug on Nomic on June 25, 2026, bundling 25 IBC transfers into one transaction to mint about 40.65 nBTC with no real Bitcoin backing it. The fraudulent tokens flowed into Osmosis’s allBTC basket and went undetected for 74 days.
Was Osmosis or the IBC protocol itself hacked?
No. Osmosis has stated publicly that its own chain and the IBC protocol were not compromised. The bug lived entirely in Nomic’s custom forwarding mechanism, and IBC simply relayed the resulting fraudulent transfer messages as designed.
How much money was lost or frozen?
Roughly 39.84 nBTC, about 36% of allBTC’s Bitcoin backing, was affected. Osmosis validators froze 22.65 BTC, worth close to $1.8 million, tied to the attacker’s address. If the remaining balance isn’t recovered, total exposure runs closer to $3.1 million.
Is allBTC fully backed again?
Not yet as of publication. A September 10 governance proposal aims to seize the frozen funds and cover the remaining roughly 17 BTC gap using Osmosis’s community pool, but the proposal was still under discussion rather than formally passed.
How does this compare to other Bitcoin bridge hacks?
It’s small by dollar value next to incidents like Ronin ($625M), Poly Network ($611M) or Wormhole ($326M), but it shares the same underlying pattern: a logic flaw in bridge code rather than a stolen private key, a category that has driven most bridge losses in recent years.
What is the safest way to hold wrapped Bitcoin in 2026?
There’s no risk-free option. Custodial tokens like WBTC and cbBTC concentrate risk in a single custodian but are heavily scrutinized given their size. Basket tokens like allBTC spread risk across multiple bridges but inherit the weakest link among them. Non-wrapped approaches like THORChain avoid vouchers entirely but carry validator and liquidity-pool risk instead.
Will Osmosis or Nomic reimburse affected users?
Osmosis’s governance proposal is designed to make allBTC holders whole by restoring full backing through seized funds and community-pool BTC, rather than a direct reimbursement program. The plan requires a passed governance vote before execution.
