Osmosis said bOSMO, a liquid staking token issued by Backbone Labs, contains a vulnerability in its redemption contract.
According to the disclosure, since April 2026, each redemption has repeatedly counted OSMO staked by Backbone’s own validator. That caused redeeming users to receive roughly 50% more OSMO than they were entitled to, with the excess effectively paid by other bOSMO holders.
A single transaction redeemed about 776,000 bOSMO
To stop further damage to other holders from community pool redemptions, the relevant parties redeemed about 776,000 bOSMO in a single transaction on Oct. 10 and withdrew about 1.2997 million OSMO. The OSMO involved in that redemption is expected to complete unbonding on Oct. 24.
1,037 accounts are set to receive compensation
Osmosis said it will compensate 1,037 accounts that held bOSMO at the time of the snapshot, using the pre-redemption rate of 1.1174 OSMO for each bOSMO. Total compensation is expected to be about 40,500 OSMO.
The payout will be distributed automatically after unbonding is completed on Oct. 24, and users do not need to take any action.
Redemption value has dropped sharply after the withdrawal
After the redemption, the asset backing of bOSMO has fallen sharply. At present, redeeming through Backbone yields only about 0.06 OSMO for each bOSMO.
Osmosis also said that because the bug has not yet been fixed, the market can still mint new bOSMO at a cost of about 0.039 OSMO per token. Pricing in some liquidity pools may therefore sit well above actual redemption value.
Osmosis advised users not to buy bOSMO or provide liquidity to related pools, and said existing liquidity providers should withdraw their funds.