USDCosmos EVM Bug Hits Four Chains as KiiChain Reports Major Loss
Validator halts contain attacks while patch disclosure draws security criticism
TL;DR
- Cosmos Labs warned affected Cosmos EVM networks to halt their chains during an ongoing security incident.
- MANTRA, TAC, KiiChain and Nesa were identified as affected, with sharply different financial outcomes.
- KiiChain blamed Cosmos Labs’ disclosure process after attackers exploited its network before validators stopped operations.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Cosmos Labs warned affected Cosmos EVM chains on Aug. 24, 2026 to ask validators to halt their networks after a security incident involving the shared module, with MANTRA, TAC, KiiChain and Nesa identified as affected. KiiChain reported the largest quantified impact, saying 148.3 million KII were taken across 18 attacks before validators stopped the network.
Cosmos Labs urges affected networks to halt operations
Cosmos Labs said the incident affected users of the Cosmos EVM module and that its security and engineering teams were responding. “An ongoing security incident has impacted users of the Cosmos EVM module. Cosmos Labs’ security and engineering teams have been proactively responding to this incident. We have advised the Cosmos EVM chains that are in contact with us to request that validators halt their chains,” Cosmos Labs said.
Cosmos EVM is a software module that allows Cosmos SDK-based chains to support the Ethereum Virtual Machine, Ethereum-compatible applications and related tools. Because several independent networks can rely on the same component, the scope of a flaw can vary depending on the software version, configuration and integration used by each chain.
The bug had been patched during the previous week, before Cosmos Labs issued its broader public warning. Cosmos EVM release notes said, “this release contains important security fixes. We recommend all chains upgrade to this patch release as soon as possible using a coordinated upgrade.” The release was not accompanied by an equivalent warning on Cosmos Labs’ official X account before the affected-chain incidents described in the available information.
The original disclosure was branded “negligent AF,” while Cosmos’ security policy was described as following a “silent patch model.” Criticism centered on whether downstream chains received sufficient warning and time to upgrade before the fix became publicly visible.
KiiChain says losses were avoidable
KiiChain said the vulnerability was located in Cosmos EVM code rather than KiiChain-specific code, saying its network had used the module without modification. The project called its losses “avoidable” and blamed the disclosure process, citing a lack of advance notice, failure to flag the update as critical and delays in communicating the patch.
“Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit,” KiiChain said in its postmortem.
KiiChain said 80.7 million KII, equal to 54% of the exploited tokens, could be recovered because they had not left the chain. The remaining arithmetic difference between the reported total and recoverable amount is 67.6 million KII, although that figure was not separately identified by KiiChain as an unrecoverable loss.
The KiiChain wallets were drained on Aug. 22 of almost 150 million KII with a theoretical value of more than $9 million at the time. The stolen tokens were ultimately sold for about $1.6 million in BUSD, briefly crashing the token’s price.
TAC, MANTRA and Nesa take different paths
TAC was exploited on the same day as KiiChain. Validators stopped further operations after the initial unauthorized drain. MANTRA and Nesa, by contrast, announced chain halts before Cosmos Labs issued its broader warning, with no apparent user-fund losses reported for either network.
MANTRA later resumed operations after applying the updated Cosmos EVM software, while KiiChain remained offline and required validators to coordinate its next network update. The differing outcomes left each affected chain at a different stage of remediation despite their reliance on the same shared module.
Cosmos Labs said it would publish a full incident report once the matter was resolved. At the time covered by the disclosures, the technical root cause remained unresolved publicly, and affected-chain disclosures provided the main quantified record of losses and recovery measures.
A separate Cosmos EVM network, Saga EVM, lost approximately $7 million in January 2026.
FAQ
What networks were affected?
MANTRA, TAC, KiiChain and Nesa were identified as affected Cosmos EVM networks.
Why did Cosmos Labs request chain halts?
The halts were used to restrict further blockchain state changes while security teams investigated.
Did MANTRA resume operations?
Yes. MANTRA restarted after deploying the updated Cosmos EVM software.
Is KiiChain operating again?
KiiChain remained offline pending a coordinated validator update.
This article has been refined and enhanced by ChatGPT.
