Cosmos Labs has told any blockchain running its Cosmos EVM module below v0.6.2 or v0.7.2 to halt immediately, six days after a related patch shipped without a security advisory. The recommendation follows attacks on three chains sharing the module's code, MANTRA, TAC and KiiChain, between Aug. 20 and Aug. 22. KiiChain says the exploit cost it 148 million KII and that two of the three underlying defects remain unfixed upstream.
Three Chains Hit, Two Still Frozen
Cosmos Labs posted on Tuesday at 11:19 a.m. New York time that teams should "immediately halt the blockchain and upgrade it to include the patches in those releases." MANTRA, TAC and KiiChain were all attacked between Aug. 20 and Aug. 22 after running the shared module. TAC and KiiChain remain frozen, while MANTRA resumed block production around 05:30 UTC on Aug. 22 on a patched v8.4.0 binary.
KiiChain's incident report says an attacker drained 148 million KII on Aug. 22 by repeating the same technique 18 times against different targets, worth roughly $9.7 million at the $0.0653 KII traded at 21:00 UTC that day. The chain halted at block 9,355,723, with 80.7 million KII sitting frozen in attacker addresses the halt immobilized, to be moved to recovery wallets at restart. Another 64.6 million tokens bridged to BNB Smart Chain were sold on decentralized exchanges for roughly 1.61 million BUSD.
A Vesting Account Exploit
The report attributes the drain to three upstream defects: an underflow in the staking precompile when it writes a post-delegation balance back to the EVM, plus two bugs KiiChain says are still undisclosed. The attacker computed the address an exploit contract would deploy to, converted it into a vesting account, then deployed the contract to delegate one wei more than its spendable balance, underflowing its mirrored balance. Total supply was never inflated, and each drain was capped at the victim's real balance.
Disclosure Under Fire
KiiChain's report says Cosmos Labs published a fix for one defect on Aug. 19 without flagging it as security critical, and did not tell affected chains a public release had happened until Aug. 21. The halt recommendation came only on Aug. 22, after all three chains had already been compromised. Cosmos Labs has commented twice on the incident on X but has not responded to KiiChain's account of the disclosure timeline.
Token Prices Reel
KII plunged 83% once the chain stopped and traded at $0.0595 on Tuesday, down 21% on the week. TAC bottomed at $0.000305 on Aug. 23, 88% below its pre-selloff price, with tracked total value locked falling to $589,584 from $763,256 before the attack. MANTRA traded flat at $0.0042, and ATOM, unaffected because Cosmos Hub does not run the EVM module, traded at $1.54, up 8.8% on the week.
This is the second exploit of the shared Cosmos EVM codebase this year, after an attacker took roughly $7 million from Saga's network in January through a separate precompile flaw. KiiChain says it has reproduced two of the three current fixes on an isolated localnet and blocked vesting account creation as a temporary measure, but neither KiiChain nor TAC has given a date for coming back online.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
