Osmosis discovered a vulnerability in the bOSMO redemption contract and will compensate approximately 40,500 OSMO to 1,037 accounts.

BlockBeats news, October 16 — According to disclosures from the Osmosis Community Hall, the liquid staking token bOSMO issued by Backbone Labs has a redemption contract vulnerability. Since April 2026, each redemption under the contract has repeatedly counted OSMO staked by Backbone's own validators, causing redeeming users to actually receive about 50% more OSMO than they should, with the excess paid by other bOSMO holders. To avoid further harming the interests of other holders when the community pool redeems, the relevant parties redeemed approximately 776,000 bOSMO in a single transaction on October 10, withdrawing approximately 1,299,700 OSMO. The OSMO involved in this redemption is expected to complete unbonding on October 24.

Osmosis stated that it will compensate approximately 40,508 OSMO to the 1,037 accounts holding bOSMO at the snapshot, based on the pre-redemption ratio of 1.1174 OSMO per bOSMO. The funds will be automatically distributed after unbonding is completed on October 24, and users need take no action. However, after the redemption, the asset backing of bOSMO has dropped sharply, and currently redeeming each bOSMO through Backbone yields only about 0.06 OSMO. Because the vulnerability has not yet been fixed, the market can still mint new bOSMO at a cost of about 0.039 OSMO, and pricing in some liquidity pools may be significantly higher than the actual redemption value. Osmosis therefore advises users not to buy bOSMO or provide liquidity to related liquidity pools, and advises existing liquidity providers to withdraw their funds.