Cosmos ecosystem shaken by 40 BTC Nomic exploit that went undetected for 74 days

The Cosmos ecosystem faced a major security setback after an attacker exploited Nomic's custom forwarding mechanism on June 25, 2026, minting over 40 BTC of unbacked nBTC. The exploit went undetected for 74 days, leaving Osmosis's synthetic allBTC asset 36% unbacked. In response, Osmosis paused allBTC operations and proposed a recovery plan using community funds. The incident triggered an 8.3% drop in ATOM's price, overshadowing the launch of Injective's native USDC standard.

Nomic nBTC exploit mechanics

• ▪The exploit did not compromise Osmosis or the Inter-Blockchain Communication (IBC) protocol itself, as the bug was located in Nomic's custom forwarding mechanism.
• ▪The attacker of the Nomic chain managed to cash out approximately $1 million by sending 671 ETH to Tornado Cash via Ethereum.
• ▪An attacker exploited a vulnerability on the Nomic chain, a Cosmos-based Bitcoin bridge, to double-spend nBTC and send false vouchers to the Osmosis decentralized exchange.
• ▪The attacker combined two separate bugs in Nomic's custom forwarding mechanism to mint 40.650602 BTC of nBTC on Osmosis with no Bitcoin backing.

74-day detection delay

• ▪The Nomic project appears to be inactive, with its official X account last posting in 2024 and its GitHub repository receiving its last commit in 2022.
• ▪The Nomic exploit occurred on June 25, 2026, but went undetected and undisclosed by both Osmosis and Nomic for 74 days.
• ▪The Nomic exploit was only discovered after a halt of the Nomic protocol prompted Osmosis to investigate its holdings.

Osmosis allBTC backing shortfall

• ▪The Nomic exploit compromised approximately 39.84 nBTC, which represented about 36% of the backing for Osmosis's allBTC asset and 30% of Osmosis's total Bitcoin exposure.
• ▪On September 9, 2026, Osmosis paused minting, redemption, deposits, and withdrawals for its synthetic Bitcoin asset, allBTC, following the discovery of the Nomic exploit.
• ▪A total of 22.65 BTC from the Nomic exploit remained untouched in the attacker's account as allBTC and was frozen by Osmosis through an emergency upgrade.

ATOM price decline

• ▪The Cosmos Partner Network includes institutions like BitGo, Galaxy Digital, OpenZeppelin, Blockdaemon, Hypernative, and Blockchain.com to help banks move tokenized deposits.
• ▪The Cosmos (ATOM) price decline followed a 12% spike and doubling of spot volume triggered by the announcement of a 17-member Cosmos Partner Network.
• ▪Cosmos (ATOM) experienced an 8.3% decline over a 24-hour period following the disclosure of the Nomic exploit on September 9, 2026.

Cosmos ecosystem recovery plan

• ▪The proposed Osmosis recovery plan includes seizing the frozen 22.65 allBTC from the attacker's account and cancelling a pending USDC.noble liquidity re-deployment.
• ▪Osmosis proposed a recovery plan to fill the 40 BTC shortfall in allBTC backing using governance and the Osmosis Community Pool.

Injective native USDC standard

• ▪Transaction fees generated from Injective USDC activity will fund programmatic buybacks of ATOM, the native token of Cosmos Hub.
• ▪Injective launched native USDC on its mainnet via Circle's Cross-Chain Transfer Protocol (CCTP), which has been adopted as the canonical stablecoin standard across the Cosmos ecosystem.
• ▪Cosmos Hub, dYdX, and Skip:Go have integrated Injective USDC with a minimum four-year adoption window to replace Noble, which exited USDC issuance in early 2026.