{ "version": 1, "event_id": "evt_dacf8d366b34d78d", "url": "https://xiyu.news/events/evt_dacf8d366b34d78d/", "json": "https://xiyu.news/api/events/evt_dacf8d366b34d78d.json", "type": "security_incident", "status": "developing", "category": "crypto", "title": { "zh": "Nomic 桥漏洞导致 allBTC 部分失去支撑，Osmosis 冻结 22.65 枚 BTC", "en": "Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves" }, "current_state": { "zh": "Osmosis已通过紧急升级冻结22.65 allBTC；allBTC仍有约36%无支撑；治理提案拟填补40 BTC缺口。", "en": "Osmosis has frozen 22.65 allBTC via emergency upgrade; allBTC remains ~36% unbacked; governance proposal seeks to fill the 40 BTC shortfall." }, "first_seen_at": "2026-09-10T09:03:46.634022+00:00", "last_updated_at": "2026-09-11T16:40:49.044823+00:00", "last_material_change_at": "2026-09-11T16:40:49.044823+00:00", "confidence": 0.75, "updates_count": 2, "sources_count": 2, "entities": [ "nomic", "osmosis" ], "identifiers": [], "topics": [ "bridge-exploit", "bridge-security", "cosmos", "defi-security", "osmosis" ], "updates": [ { "update_id": "upd_3afcd463b325f469", "event_id": "evt_dacf8d366b34d78d", "occurred_at": "2026-09-10T08:50:29Z", "published_at": "2026-09-10T08:50:29Z", "first_seen_at": "2026-09-10T09:03:46.634022Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Nomic 桥漏洞导致 allBTC 部分失去支撑，Osmosis 冻结 22.65 枚 BTC", "title_en": "Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves", "what_changed_zh": "Osmosis 已冻结 22.65 枚 BTC，原因是 Nomic 自定义转发逻辑中的缺陷让攻击者得以双花并铸造虚假的 nBTC 凭证，这些凭证随后通过 IBC 跨链到 Osmosis 并被计入 allBTC 的合法支撑资产。这批无效 nBTC 占 allBTC 支撑的 36.03%，因此 allBTC 的铸造与赎回已被暂停，等待治理层决定如何补足储备。\n\n这起事件表明，某条桥的转发逻辑漏洞可以传导到另一个协议的封装资产篮子中，使持有人整体暴露在储备缺口之下，而不是遭遇直接盗币。同时它把治理投票推到了用户追偿的核心位置，这一模式对 Cosmos 生态内所有封装比特币产品都具有参照意义。\n\n截至报道截止时，allBTC 流通量为 110.57 枚，篮子中持有 39.84 枚 nBTC；即使 22.65 枚被冻结的 BTC 全部追回，仍有约 17.19 枚 BTC 的缺口需要由社区池补足。链上研究员 Rarma 将主要铸造活动追溯至 6 月 25 日，并指出 7 月 17 日活动中产生的 22.65060846 枚 allBTC 在追踪发布时仍未移动，而官方公开披露发生在两个多月之后；Osmosis 负责管理 allBTC 合约，一个 3-of-6 的 moderator 子 DAO 可暂停池子或将某成分资产标记为受损，而 Nomic 的托管文档规定储备支出需要代表其签名集合 90% 以上投票权的签名。", "what_changed_en": "Osmosis froze 22.65 BTC after a flaw in Nomic's forwarding system enabled false-voucher minting of nBTC, leaving roughly 36% of allBTC's backing invalid and minting/redemption paused pending governance action.", "current_state_zh": "Osmosis 已冻结 22.65 枚 BTC，原因是 Nomic 自定义转发逻辑中的缺陷让攻击者得以双花并铸造虚假的 nBTC 凭证，这些凭证随后通过 IBC 跨链到 Osmosis 并被计入 allBTC 的合法支撑资产。这批无效 nBTC 占 allBTC 支撑的 36.03%，因此 allBTC 的铸造与赎回已被暂停，等待治理层决定如何补足储备。\n\n这起事件表明，某条桥的转发逻辑漏洞可以传导到另一个协议的封装资产篮子中，使持有人整体暴露在储备缺口之下，而不是遭遇直接盗币。同时它把治理投票推到了用户追偿的核心位置，这一模式对 Cosmos 生态内所有封装比特币产品都具有参照意义。\n\n截至报道截止时，allBTC 流通量为 110.57 枚，篮子中持有 39.84 枚 nBTC；即使 22.65 枚被冻结的 BTC 全部追回，仍有约 17.19 枚 BTC 的缺口需要由社区池补足。链上研究员 Rarma 将主要铸造活动追溯至 6 月 25 日，并指出 7 月 17 日活动中产生的 22.65060846 枚 allBTC 在追踪发布时仍未移动，而官方公开披露发生在两个多月之后；Osmosis 负责管理 allBTC 合约，一个 3-of-6 的 moderator 子 DAO 可暂停池子或将某成分资产标记为受损，而 Nomic 的托管文档规定储备支出需要代表其签名集合 90% 以上投票权的签名。", "current_state_en": "Osmosis froze 22.65 BTC after a flaw in Nomic's forwarding system enabled false-voucher minting of nBTC, leaving roughly 36% of allBTC's backing invalid and minting/redemption paused pending governance action.", "detailed_summary_zh": "Osmosis froze 22.65 BTC after a flaw in Nomic's forwarding system enabled false-voucher minting of nBTC, leaving roughly 36% of allBTC's backing invalid and minting/redemption paused pending governance action.", "detailed_summary_en": "Osmosis froze 22.65 BTC after a flaw in Nomic's forwarding system enabled false-voucher minting of nBTC, leaving roughly 36% of allBTC's backing invalid and minting/redemption paused pending governance action.", "background_zh": "allBTC 是 Osmosis 上的一种代币化比特币资产，其发行以链上持有的一篮子比特币变体作为支撑，其中包括由 Nomic 桥发行的 nBTC。Nomic 是一条为比特币提供去中心化托管方案的 Cosmos 区块链，其铸造的 nBTC 与 BTC 按 1:1 支撑，并通过 Cosmos 生态通用的跨链通信协议 IBC 在各链之间转移价值。桥转发逻辑中的双花意味着同一笔底层 BTC 被重复计算，因而在没有新比特币进入托管的情况下生成了看似有效的凭证。", "background_en": "allBTC is a tokenized Bitcoin asset on Osmosis minted against a basket of Bitcoin variants held on the chain, including nBTC issued by the Nomic bridge. Nomic is a Cosmos blockchain that offers decentralized custody for Bitcoin and mints nBTC as a 1:1 BTC-backed token, moving value between chains via IBC, the Inter-Blockchain Communication protocol used across Cosmos. A double-spend in a bridge's forwarding logic means the same underlying BTC was effectively counted twice, so vouchers that looked valid were created without new Bitcoin entering custody.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "风险敞口集中在持有 allBTC 或 nBTC 的 Osmosis 流动性池与 Cosmos DeFi 头寸上，冻结使铸造和赎回通道关闭，受影响价值约 150 万美元。更广泛的传导渠道是跨链与封装比特币资产的情绪与流动性，因为未解决的储备缺口可能促使交易者重新定价整个 Cosmos 生态的桥接风险。", "market_impact_en": "The exposure is concentrated in Osmosis liquidity pools and Cosmos DeFi positions holding allBTC or nBTC, where the freeze blocks entry and exit through minting and redemption and leaves the affected value at roughly $1.5M. The wider transmission channel is sentiment and liquidity around bridged and wrapped Bitcoin assets, since unresolved backing gaps can prompt traders to reprice bridge risk across the Cosmos ecosystem.", "importance_score": 8.0, "references": [ { "url": "https://github.com/nomic-io/nomic", "title": "GitHub - nomic-io/nomic: Decentralized Custody Engine for Bitcoin · GitHub" }, { "url": "https://www.cryptotimes.io/2026/09/09/osmosis-freezes-22-65-btc-after-nomic-exploit-hits-alloyed-btc-backing/", "title": "Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing. About 36% of allBTC Now Has No Bitcoin Behind It." }, { "url": "https://www.tradingview.com/news/cryptobriefing:f57f4f3ba094b:0-osmosis-pauses-operations-after-nomic-chain-nbtc-exploit-freezes-22-65-btc/", "title": "Osmosis pauses operations after Nomic Chain nBTC exploit freezes..." } ], "confidence": 0.75, "story_ids": [ "rss:cryptoslate.com_feed_:674de2989502d767" ], "sources": [ { "url": "https://cryptoslate.com/osmosis-freezes-22-65-btc-after-nomic-forwarding-bug-compromises-bitcoin-reserves/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_6e005346860c0eab", "event_id": "evt_dacf8d366b34d78d", "occurred_at": "2026-09-11T15:59:39Z", "published_at": "2026-09-11T15:59:39Z", "first_seen_at": "2026-09-11T16:40:49.044823Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Osmosis 历时 74 天才发现 40 BTC 的 Nomic 漏洞", "title_en": "Osmosis took 74 days to discover 40-BTC Nomic exploit", "what_changed_zh": "新披露：攻击发生于6月25日，攻击者利用两个漏洞凭空铸造40.650602 BTC的nBTC；74天后才发现；攻击者通过671 ETH至Tornado Cash套现约100万美元；治理提案拟没收冻结的22.65 allBTC、取消USDC.noble流动性重新部署并动用Community Pool填补40 BTC缺口。", "what_changed_en": "Newly disclosed: exploit occurred June 25; attacker used two bugs to mint 40.650602 BTC of unbacked nBTC; detection took 74 days; attacker cashed out ~$1M via 671 ETH to Tornado Cash; governance proposal would seize frozen 22.65 allBTC, cancel USDC.noble liquidity re-deployment, and pull Community Pool allBTC to fill the 40 BTC shortfall.", "current_state_zh": "Osmosis已通过紧急升级冻结22.65 allBTC；allBTC仍有约36%无支撑；治理提案拟填补40 BTC缺口。", "current_state_en": "Osmosis has frozen 22.65 allBTC via emergency upgrade; allBTC remains ~36% unbacked; governance proposal seeks to fill the 40 BTC shortfall.", "detailed_summary_zh": "An attacker exploited two bugs to mint over 40 BTC of unbacked nBTC on Osmosis on June 25, and the 74-day detection delay left Osmosis's allBTC 36% unbacked until a Nomic protocol halt triggered an emergency freeze.", "detailed_summary_en": "An attacker exploited two bugs to mint over 40 BTC of unbacked nBTC on Osmosis on June 25, and the 74-day detection delay left Osmosis's allBTC 36% unbacked until a Nomic protocol halt triggered an emergency freeze.", "background_zh": "nBTC 是通过 Nomic 一层区块链桥接的比特币，借助跨链通信协议 IBC（连接各 Cosmos 应用链的消息标准）得以在 Cosmos 各类应用中流通与使用。allBTC 则是生态内最大去中心化交易所 Osmosis 上使用的比特币代表资产，其价值来自桥所持有的底层 BTC 储备。Nomic 本身似乎已不再积极维护，其 X 账号自 2024 年起停止更新，GitHub 最后一次提交约在两年前，这使责任追究与资金追回变得更加复杂。", "background_en": "nBTC is Bitcoin bridged through the Nomic Layer 1 blockchain, which makes it transferable and usable across Cosmos applications via the Inter-Blockchain Communication (IBC) protocol, the messaging standard that links Cosmos app chains. allBTC is the Bitcoin representation used on Osmosis, the ecosystem's largest decentralized exchange, and it derives its value from the underlying BTC backing held by the bridge. Nomic itself appears no longer actively maintained, with its X account silent since 2024 and its last GitHub commit about two years old, which complicates accountability and recovery.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "这一储备缺口直接影响到 Osmosis 上 allBTC 与 nBTC 的持有者及相关流动性池，因为在紧急冻结之前该衍生品有 36% 的支撑资产缺失，使以 BTC 计价的 Cosmos 流动性通过“储备支撑”这一渠道承压，而不仅是价格波动。事件中涉及以太坊的 671 ETH 流入 Tornado Cash，也将此事与更广泛的跨链桥攻击资金流联系在一起，进一步打击市场对 Cosmos 跨链资产及其上市场所的情绪。", "market_impact_en": "The shortfall directly affects holders and liquidity pools of allBTC and nBTC on Osmosis, since 36% of the derivative's backing was missing until the emergency freeze, leaving BTC-denominated Cosmos liquidity exposed through the bridge-backing channel rather than through price alone. The Ethereum leg — 671 ETH routed to Tornado Cash — also ties the event to broader bridge-exploit flows, compounding sentiment pressure on Cosmos cross-chain assets and on the venues that list them.", "importance_score": 7.5, "references": [ { "url": "https://nipiq.com/entities/variants/nomic-nbtc", "title": "Nomic NBTC - Bitcoin Variants | nipiQ" }, { "url": "https://cryptoslate.com/bitcoin-arrives-on-cosmos-with-nomic-nbtc-upgrade/", "title": "Bitcoin arrives on Cosmos with Nomic nBTC upgrade" }, { "url": "https://blog.cosmos.network/developer-deep-dive-cosmos-ibc-5855aaf183fe", "title": "Developer Deep Dive — Cosmos IBC. Alongside the Tendermint high" } ], "confidence": 0.95, "story_ids": [ "rss:protos.com_feed_:e6a7a4cf53344add" ], "sources": [ { "url": "https://protos.com/osmosis-took-74-days-to-discover-40-btc-nomic-exploit/", "label": "Protos", "source_type": "rss", "official": false } ] } ] }