Osmosis Takes 74 Days to Uncover 40-BTC Exploit in Nomic Protocol

Osmosis, a decentralized exchange, has disclosed that it took them 74 days to identify an exploit that allowed an attacker to mint over 40 BTC worth of Nomic's nBTC out of thin air. The incident occurred on June 25, but it wasn't until an investigation was prompted by a halt of the Nomic protocol that the exploit came to light.

During this period, it was found that Osmosis's allBTC was 36% unbacked. The exploit involved a double-spending mechanism that enabled the attacker to generate a transaction minting 40.65 BTC of nBTC without any actual BTC backing it. Fortunately, the attacker left a significant portion of the proceeds untouched, which was later frozen through an emergency upgrade.

In response to the incident, Osmosis has proposed measures to fill the 40 BTC shortfall in allBTC backing, including seizing frozen assets from the attacker’s account and reallocating funds from a Community Pool.

This exploit raises broader concerns regarding the security practices within the Cosmos ecosystem, especially following a series of incidents related to another bug affecting multiple projects. The delayed discovery of the Nomic exploit has drawn criticism, highlighting the need for improved security measures and transparency in the blockchain space.