Osmosis Took 74 Days to Discover 40-BTC Nomic Exploit

Osmosis took 74 days to discover a Nomic exploit that minted roughly 40 BTC worth of unbacked nBTC on its network, exposing a wrapped-Bitcoin accounting failure that left the protocol's pooled Bitcoin token only partially collateralized. The delay, disclosed in a September 10, 2026 governance proposal, is the central concern: counterfeit Bitcoin vouchers circulated for more than two months before a chain halt forced a backing check. WHAT TO KNOW The incident report describes a Nomic exploit involving roughly 40 BTC of unbacked nBTC minted on Osmosis. Osmosis took 74 days to discover the exploit, according to the protocol's governance proposal. What the 40-BTC Nomic exploit report says Nomic is a bridge protocol that issues nBTC, an IBC-transferable Bitcoin voucher, into the Cosmos ecosystem. Osmosis, the Cosmos decentralized exchange, is the entity named in the discovery claim, having accepted those vouchers as valid inbound transfers. For related coverage, see Albuquerque Bans Bitcoin ATMs: 45 Days to Remove Them. On June 25, 2026, the Nomic bridge minted 40.650602 BTC worth of nBTC on Osmosis without corresponding Bitcoin held in reserve, according to the governance proposal. This figure represents unbacked issuance rather than a confirmed net theft or recovered funds. For related coverage, see Blockstream Rejects Ransom After Alleged 4,000 BTC Liquid Hack. The linked forensic report places the Osmosis credit at 21:50:08 UTC on June 25, in block 64910685, involving 25 packets carrying consecutive sequences 9286 through 9310. It attributes the flaw to missing sender authorization and self-transfer escrow accounting inside Nomic, and states that IBC replay protection was not bypassed; Osmosis accepted valid proofs of what were, in fact, unbacked Nomic commitments. For related coverage, see Bitcoin Takes 42% of Repeat Crypto Purchases: Paybis. Notably, the report says no Bitcoin was stolen directly from Nomic's on-chain reserve. Its reconstructed checkpoint ledger reconciles to 0.746000 BTC with a stated 0.000000 BTC discrepancy, a finding of the author-affiliated analysis rather than an independently rerun audit. The exploit inflated the voucher supply rather than draining custodied coins. The reported 74-day delay in discovering the exploit The counterfeit vouchers went undetected for a full quarter. The governance proposal states that Nomic halted on September 7, 2026, and that the halt prompted the backing check that exposed the mint after 74 days; June 25 to September 7 independently counts as 74 calendar days. Time until discovery 74 days According to the Osmosis governance proposal, unbacked nBTC was minted on June 25, 2026. The Nomic halt on September 7 prompted the backing check that exposed it, 74 calendar days later. Discovery is distinct from disclosure.