Osmosis has discovered a vulnerability in its bOSMO redemption contract, and will compensate approximately 40,500 OSMO tokens to 1,037 affected accounts.

According to a disclosure from the Osmosis Community Hall, the liquid staking token bOSMO issued by Backbone Labs has a redemption contract vulnerability. Since April 2026, the contract has been double-counting OSMO staked by Backbone’s own validators during each redemption, leaving users receiving roughly 50% more OSMO than they are entitled to, with the excess costs covered by other bOSMO holders. To avoid further harm to other holders during community fund pool redemptions, relevant parties redeemed around 776,000 bOSMO in a single transaction on October 10, extracting approximately 1.2997 million OSMO. The OSMO involved in this redemption is expected to complete unbonding on October 24. Osmosis announced it will compensate 1,037 accounts holding bOSMO at the snapshot, totaling about 40,508 OSMO, calculated at a pre-redemption rate of 1.1174 OSMO per bOSMO. The compensation will be automatically distributed after unbonding finishes on October 24, with no action needed from users. However, bOSMO’s asset backing has dropped sharply post-redemption: currently, redeeming 1 bOSMO via Backbone only yields around 0.06 OSMO. As the vulnerability remains unpatched, new bOSMO can still be minted at a cost of roughly 0.039 OSMO, which may cause some liquidity pools to have prices significantly deviating from actual redemption value. Osmosis therefore advises users not to purchase bOSMO or provide liquidity to related pools, and urges existing liquidity providers to withdraw their funds.