Cosmos EVM Bug Drains Three Chains After Early Public Disclosure

What happened

On 22 August 2026, an attacker repeatedly exploited a vulnerability in cosmos/evm, the EVM compatibility module shared by multiple independent Cosmos-based chains, to drain funds from KiiChain. According to KiiChain's own postmortem, the attacker pre-computed the address that a smart contract would deploy to, converted that address into a vesting account, then deployed the contract onto it. The contract inherited vesting status, delegated one wei more than its spendable balance, and triggered an underflow that inflated its mirrored EVM balance to roughly 2^256. Repeated 18 times, this drained 148,326,583.15 KII — about $1.6 million — before validators halted the chain.

Because the flaw lived in shared module code rather than any single chain's custom logic, it was not unique to KiiChain. TAC, a Telegram-focused Cosmos chain, lost roughly 3 billion TAC tokens (about $7.5 million) and halted after one account was drained. Nesa Chain reported tokens nominally worth $50 million taken, though thin liquidity limited the attacker's actual profit to around $60,000. MANTRA halted its chain as a precaution and reported no user funds impacted, resuming after roughly 30 hours on a patched Cosmos EVM release.

A disclosure process that worked against itself

The part drawing the sharpest criticism is not the bug itself — underflows in balance-mirroring code are a known hazard class — but how the fix reached the public. Cosmos Labs published the patch openly rather than distributing it privately to chain operators first, and did not mark the change as security-critical. Multiple affected teams say they were not notified until 21 August, two days after the fix was already visible in the public commit history.

This loss was avoidable. ... Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit. Standard responsible disclosure exists precisely to prevent this. Cosmos Labs gave no advance notice to downstream chains.

— KiiChain postmortem

That sequencing turns a routine patch into a race: anyone monitoring the public repository gets a head start on exploitation, while operators who don't have private, structured relationships with the upstream maintainer find out only after the damage is done. Cosmos Labs subsequently urged validators across affected EVM chains to halt operations while it assessed the scope — but as of the incident becoming public, it had not published its own technical incident report, so downstream teams could patch known exposure without being able to confirm every related weakness was closed.

Why it matters beyond Cosmos

This is a software supply-chain problem wearing blockchain clothing. cosmos/evm is dependency code that KiiChain, TAC, MANTRA, and others run largely unmodified — functionally identical to an npm or PyPI package embedded across unrelated products. The failure mode is the same one that shows up in conventional supply-chain incidents: a maintainer fixes an upstream flaw without accounting for who else is running the vulnerable version, and the fix itself becomes the disclosure. For any organization consuming shared framework or SDK code — on-chain or off — the lesson holds: a security fix isn't complete until the operators depending on that code have had a real window to apply it before the details are public.

FAQ