Coding Flaw Let Attacker Mint Fake Bitcoin Tokens, Went Undetected for 74 Days

A software flaw in Nomic's custom IBC forwarding path let an attacker mint unbacked nBTC tokens and move most of them into Osmosis's Alloyed BTC basket, a decentralised finance product meant to represent real bitcoin backing. The exploit happened on 25 June but wasn't discovered until early September, meaning roughly 36% of the basket's backing was missing for 74 days without anyone noticing.

According to Osmosis, the underlying issue was in Nomic's own code rather than Osmosis or the broader IBC network itself. An independent researcher who reviewed the code found that one deposit process, out of 18 similar ones in the file, mistakenly created the same bitcoin deposit twice, and the system never checked who actually controlled the account receiving the extra tokens. The attack reportedly cost as little as one satoshi to carry out, making it extremely cheap to exploit.

Once alerted, Osmosis suspended deposits and withdrawals linked to Nomic and Alloyed BTC, worked with validators to lock the attacker's remaining funds, and proposed a governance vote to seize those assets and use community funds to restore full backing. The faulty code reportedly remained unchanged in Nomic's development branch even after the researcher publicly detailed the flaw, with a fix only following shortly after.

Key Takeaway: Businesses relying on cross-chain or bridged crypto assets should understand that such tokens are only as trustworthy as the custom code minting them, and should favour platforms with regular independent code audits and transparent incident monitoring.