Osmosis Reveals 40.65 Bitcoin (BTC) Exploit on Nomic Bridge Found After 74 Days

40.65 Bitcoin (BTC) Minted Unbacked on Osmosis

An attacker generated 40.650602 BTC worth of wrapped Bitcoin — nBTC on the Nomic bridge — with no underlying collateral on June 25, and the breach went undetected for 74 days until a halt of the Nomic protocol prompted an investigation into Osmosis's holdings. Osmosis, the Cosmos-based decentralized exchange whose allBTC composite reserve later proved 36% unbacked, confirmed the incident in a Sept. 9 statement, saying the exploiter combined two separate bugs to double-spend nBTC and deliver false vouchers to the exchange. According to the project's post-mortem, Osmosis and the IBC interchain messaging layer were not compromised; the flaw sat in a custom forwarding mechanism on Nomic itself. The on-chain trail shows the attacker managed to cash out roughly $1 million worth of the loot at the time by sending 671 ETH to Tornado Cash through Ethereum — a flow visible in the public transaction history for that address. The remaining proceeds were luckier for the exchange: a considerable chunk sat untouched as allBTC and was frozen earlier this week through an emergency upgrade, locking 22.65 allBTC in the attacker's account. Nomic itself appears effectively abandoned — its public repository recorded its last commit two years ago and the project's X account last posted in 2024. A proposal now before Osmosis's governance forum would restore full backing for the 40 BTC shortfall by seizing the frozen 22.65 allBTC, cancelling a pending liquidity re-deployment of USDC.noble, and pulling additional allBTC from the Community Pool. The incident lands as the Cosmos ecosystem digests a separate string of exploits tied to a widely used Cosmos EVM module, a disclosure sequence that victim KiiChain publicly branded avoidable.

Solo Miner Wins Block 966351

Against that backdrop of broken bridge trust, the Bitcoin base layer delivered its own reminder of how proof-of-work settlement actually functions. An individual miner running solo mining hardware found block 966351 entirely alone on Sept. 10, 2026, at 8:06:46 p.m. Korea time (11:06:46 UTC), collecting the full block reward of 3.14728115 Bitcoin (BTC) — roughly $243,316 at the confirmation time shown by block explorers. The on-chain record is unambiguous: the reward comprised the 3.125 BTC subsidy set after the 2024 halving plus 0.02228115 BTC in transaction fees across 2,627 included transactions. Block explorers list the miner as “Unknown,” while the coinbase message reads “ckpool /braiinssolo/,” identifying the Braiins Solo service through which the hashpower was pointed rather than the miner's identity, equipment or hashrate, which remain undisclosed. It was the first solo success in approximately 38 days and 9 hours: the previous instance came at block 960804 on Aug. 3, when a solo CK miner captured 3.15689830 BTC. The economics differ sharply from pooled mining, where participants split rewards pro-rata by contributed hashrate; a solo winner takes the entire subsidy and fee haul, but earns nothing until a block is found. With the dollar value of any given block floating against BTC's price, the only fixed figure on-chain is the 3.14728115 BTC itself — and with the miner's electricity and hardware costs unpublished, the haul should not be read as pure net profit.

Two Trust Models Under One Asset

The pairing is instructive for anyone holding Bitcoin exposure beyond the base chain. The solo block reward required no custodian, no bridge and no disclosure timeline — the ledger itself is the audit, and the 38-day gap between wins is just variance in a probabilistic lottery. The Nomic exploit is the mirror image: a wrapped asset whose backing depended on unmaintained code, with a 74-day detection lag and a shortfall that governance must now vote to repair. Our reading of the post-mortem and the on-chain Tornado Cash flow is that transparency worked after the fact — the 671 ETH trail and the frozen 22.65 allBTC are traceable precisely because the chains are public — but detection arrived only when the protocol stopped. As BTCfi wrapped-asset designs multiply, the backlog of unaudited forwarding mechanisms remains the sector's quiet balance-sheet risk.