One Deposit, Two Receipts: How a Wrapper's Double-Spend Left 36% of Osmosis's Bitcoin Unbacked

A bitcoin wrapper fails in a way that looks like nothing at all. The price does not move. No signature looks wrong. On June 25, 2026, a flaw in Nomic's deposit-forwarding code let one bitcoin deposit be credited twice, minting about 40.65 nBTC against a deposit that existed once — and by the time Osmosis disclosed the problem on September 9, 39.84 of those tokens, roughly 36% of its alloyed bitcoin token's entire backing, had been a receipt for bitcoin nobody had deposited.

What makes it worth taking apart is that the mechanism is the least exotic one available: no stolen key, no manipulated oracle, no forged signature. A wrapper's own bookkeeping was wrong, and nothing in the system was built to notice. The same week produced a second unbacking at Symbiosis, and the week before a third at Liquid, through the same category of failure at a much larger scale.

1. The Incident in Six Lines

2. What nBTC and allBTC Actually Are

Nomic is a Cosmos-chain custodian that issues nBTC against bitcoin deposits. Its custom deposit-forwarding mechanism is a convenience feature: rather than asking a user to complete a deposit step by step, it watches for incoming bitcoin and issues the corresponding nBTC automatically. allBTC, meanwhile, is Osmosis's alloyed bitcoin token — a wrapper of wrappers that merges several different bridged bitcoin versions, nBTC among them, into one fungible asset so that liquidity does not fragment across half a dozen near-identical tokens.

The structural consequence is the part holders rarely price in. An alloyed token has one shared backing and therefore one shared point of failure: when any single issuer's accounting breaks, every holder of the blend absorbs it, including holders who never touched nBTC and may not know which tokens sit inside the blend. That is why a $3.15M bookkeeping error at one small Cosmos custodian became a solvency question for an entire pool, and why the subject of Osmosis's notice was not nBTC but allBTC.

3. Timeline

4. Where It Broke: One Deposit, Two Receipts

The attacker did not need a key. Nomic's forwarding layer watched for incoming deposits and issued nBTC automatically, and the flaw in that layer let the same deposit be credited twice — one arrival, two valid-looking receipts. Twenty-five cross-chain transfers later, most of the minted supply sat inside Osmosis, indistinguishable from genuine nBTC because at the level every downstream system inspects, it was genuine: correctly formatted, properly attested, accepted by an IBC path that was working exactly as designed.

Set beside the month's other two unbackings, this case completes a small taxonomy of ways to issue a receipt for nothing. Liquid's failure was in verification — a range-proof cache collision that let unbacked L-BTC pass the checks real coins would have passed, after which a federated signature set moved genuine BTC against a fake claim. Symbiosis's was in authorization — a bridge contract that minted 46.1 billion syBTC in response to a call it should never have accepted. Nomic's was in accounting — the logic that decides whether a deposit happened. What the three share matters more than where they differ: in every case the only party verifying the reserve was the party issuing the receipt, and no independent check stood behind it.

That is also why the gap ran from June to September. An unbacked receipt cannot be detected by price, because allBTC's market held no independent view of its reserve — a quote reflects what holders believe about the backing, not the backing itself. The one instrument that would have caught this on day one is a reconciliation of tokens outstanding against a custodied reserve, run on a schedule by someone who does not issue the token. Nothing forced one, so the chain's own transparency was not enough.

5. Who Was Actually Exposed

The list is longer than the list of people who bought nBTC. Every holder of allBTC carried the hole, whether or not they had ever interacted with Nomic; so did liquidity providers in allBTC pools, and so did every venue that quoted the token at face value while 36% of what stood behind it was fiction. That is the shape of a blended-asset risk: the issuer a holder chose is not the only issuer that holder depends on.

The damage also arrived in a form that is easy to misread. Nobody's wallet was emptied. Balances were unchanged and the ledger was accurate; what changed was the ratio between tokens outstanding and the bitcoin behind them. That places wrapper failures closer to dilution than to theft — the loss is real, evenly spread, and invisible on a wallet screen, which is precisely why the discovery lag ran as long as it did.

6. The Freeze, and the Hole It Left

Osmosis's response was the fastest of the month's three recoveries. An emergency chain upgrade, v31.1.0, froze 22.65 BTC still sitting in the attacker's address before it could be moved, converting a would-be total loss into a partial one; a governance vote to seize the frozen funds is pending. It worked, and it deserves to be recorded as a precedent rather than only as a win: a validator set demonstrated that it can freeze a specific wallet mid-flight. The capability that saved this pool is the same capability that sits uneasily beside a decentralised network's assumptions, and holders of any asset on that chain now know it exists.

It is worth being precise about what a freeze can recover. It returns assets that have not yet moved; it does not restore an asset's credibility. allBTC's remaining holders end up with a token whose backing is whole only after a governance vote and a community-pool transfer — and markets will price that sequence, not the arithmetic. The portion of the proceeds already converted to about 671.1 ETH and routed to Tornado Cash is beyond any vote. A freeze recovers what has not moved yet; it does not recover what has.

7. Recovery Was Improvised in All Three Cases

The week's second unbacking, at Symbiosis, recovered differently again. On September 11 an attacker got the BridgeV2 contract on BNB Chain to mint roughly 46.1 billion syBTC — more than two thousand times bitcoin's total supply — to a fresh wallet, in a call monitoring firm Blockaid flagged within hours. Only about 4.39 WBTC was convertible through Uniswap V4 before monitored pools halted, realizing roughly $336,000: the protocol's shallow roughly $7M of total value locked capped the theft. Symbiosis suspended native bitcoin routing, recovered about 15 BTC into a team multisig, and offered a 20% white-hat bounty with a September 13 deadline. The deadline lapsed, and the bounty was redirected to informants.

Symbiosis's thinness cuts both ways, and that is the point worth keeping. The same shallow liquidity that capped the attacker's exit is what would have stopped an ordinary holder from exiting at par during the incident. Liquidity is not only the attacker's constraint; it is the holder's emergency exit, and in a wrapper incident it closes for everybody at the same moment.

Place the three recoveries side by side and the pattern is not a security perimeter but a negotiation. Liquid's actors returned 3,400 BTC on September 7 — in Bitcoin block 965,950, after Blockstream signed confirmation that its bridge nodes were patched — and kept roughly 598.5 BTC with no published bounty terms. Osmosis froze and is asking a validator majority to seize. Symbiosis secured what it could and priced the rest with a bounty nobody accepted. All three worked, to different degrees, and none of them was in place before the incident started. The Security Alliance's whitehat safe harbour — return within 72 hours, keep up to 10% capped at $1M — exists precisely so that the negotiation does not begin with whoever holds the money setting every term. Protocols that wrap value should treat a published safe harbour the way they treat an audit: as pre-incident infrastructure.

8. What a Holder Should Do

• Classify every balance by backing: native asset, exchange liability, or a receipt issued against a reserve someone else controls. The third category carries a separate, named risk.
• For every wrapped asset, name the issuer and the verification mechanism — and if the token is a blend, name the issuers inside the blend. If you cannot state in one sentence what stands behind it, you do not hold an asset; you hold an assumption.
• Prefer non-blended exposure where the choice is free. A token that merges several issuers' versions of bitcoin has several ways to break, and you only chose one of them.
• Check redeemability, not price. A wrapped token trading at par says nothing about its reserve — allBTC traded at par for weeks while more than a third of its backing did not exist.
• Size the exposure deliberately. Decide in advance what share of a working balance may sit in any single wrapped asset; a federation bug cut L-BTC's backing by roughly 95% inside an hour, and an alloyed pool carried a 36% hole for weeks.
• During an incident, follow the issuer's status page and halt notice. The freeze, the gap figure and the community-pool plan were all published there first, and swapping into thin liquidity during a depeg usually locks in the discount.

9. What to Watch

Three questions decide what this pattern becomes. First, does the Osmosis governance vote to seize the frozen 22.65 BTC pass, and does the community pool actually cover the 17.19 BTC gap — because a blend that closes its shortfall only by collective payment has answered a question about who owns the residual risk. Second, do other alloyed and bridged tokens publish reserve attestations, or does the market keep treating a blend's price as evidence of its backing? Third, does the gap between the June origination and the September disclosure appear again in the Nomic and Symbiosis post-mortems — because a failure detectable only by reconciliation, undetected for most of a quarter, is a statement about audit cadence rather than about one Cosmos custodian.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.