Cosmos Labs Urges EVM Networks to Halt Operations Following Blockchain Attacks

A vulnerability in the Cosmos EVM module has led to attacks on three separate blockchain networks. Cosmos Labs has recommended that all affected blockchains cease block production and update their software immediately.

https://twitter.com/cosmoslabs_io/status/2092270725122207904

Three Networks Targeted

The issue pertains to the Cosmos EVM, an open module that enables blockchains built on the Cosmos SDK to run Ethereum-compatible smart contracts. As multiple networks utilize the same code, a flaw could impact the entire ecosystem.

The attacks occurred between August 20 and August 22, affecting Mantra, TAC, and KiiChain. Mantra has since resumed operations following an update, while the other two remain offline.

Cosmos Labs advised networks running versions of Cosmos EVM earlier than v0.6.2 or v0.7.2 to immediately halt their blockchains and apply necessary patches. However, the exact number of potentially affected networks has not been disclosed as of now.

KiiChain Loses 148 Million Tokens

KiiChain was the only network to provide a detailed report on the incident. According to their team, an attacker drained approximately 148 million KII tokens, executing the attack 18 times across different wallets.

https://twitter.com/KiiChainio/status/2091721027583709214

After the network was halted, around 80.7 million KII tokens were frozen. Additionally, 67.6 million tokens were transferred to the BNB Smart Chain via Hyperlane, with 64.6 million sold on a decentralized exchange for about $1.61 million, and another 3 million sent to a deposit address on KuCoin.

TAC reported the movement of 2.99 billion TAC tokens, representing roughly 62% of its circulating supply, and has also paused block production.

Mantra stated that the attack affected two wallets managed by the company but did not compromise user funds, exchange assets, or partner resources. The network has resumed operations on a patched version.

Root Cause in Shared Code

KiiChain indicated that the vulnerability was not in its own code but in the Cosmos EVM itself. The attack exploited a combination of three flaws, including an overflow error in the staking precompilation function involving the EVM balance.

The attacker was able to create a contract at a predetermined address, convert it into a vesting account, and delegate one wei more than the available balance, leading to erroneous values that allowed the withdrawal of real funds from the targeted wallets. Importantly, this did not increase the total token supply in the network.

Mantra’s developers also noted, without going into specifics, that "the attacker exploited a vulnerability in a higher-level dependency used by the blockchain."

KiiChain claims that the bugs have not been publicly fixed yet, suggesting that the recent update from Cosmos Labs may not sufficiently eliminate the risk.

Criticism of Cosmos Labs for Vulnerability Disclosure

Various projects and community members have criticized Cosmos Labs for how it handled the disclosure of the vulnerability. The company posted the patch in a public repository on August 19 but, according to KiiChain, failed to notify the affected networks in advance and did not label the release as a critical security update. A warning was issued only two days later.

This left developers with the dilemma of either quickly updating validators after the public release of the fix or continuing to operate with potentially vulnerable code.

KiiChain believes that this delay created an opportunity for the attacks to occur.

"You didn’t rush. Everything is in complete disarray," commented one user on Cosmos Labs' post.

This is Not the First Incident

The Cosmos EVM has faced its second major security issue in 2026. Earlier in January, a vulnerability in another module component led to an attack on Saga EVM, resulting in losses of approximately $7 million.

In a notification released at that time, Cosmos Labs indicated that the code had been merged into the main branch in July 2024 and was in use across 15 blockchains, although this feature was disabled on six of them. One network was compromised before others could implement fixes. A permanent fix was introduced in version 0.6.0 in March. Among the teams that Cosmos Labs thanked for their involvement in testing the patch was Mantra.

It’s worth noting that participants at the Wyoming Blockchain Symposium believe that AI agents could significantly reduce costs and scale attacks on crypto projects and asset users.