Cosmos Labs urged affected Cosmos EVM chains to request validator halts on Aug. 25 as its security and engineering teams responded to an incident that had already reached multiple networks, with KiiChain reporting over 148 million KII drained through 18 repeated attacks.
What Happened
Cosmos Labs said users of the Cosmos EVM module had been affected and promised an incident report after the situation is resolved. The company did not identify the underlying vulnerability, affected chains or total losses in its initial statement. It asked teams using the module to coordinate with validators to halt block production while developers investigate and distribute a fix.
Cosmos EVM is a shared software stack that lets Cosmos SDK chains execute Ethereum-compatible smart contracts. A vulnerability in a common module can expose independent networks running affected versions or configurations.
KiiChain and TAC Disclose Token Drains
KiiChain said an attacker drained 148,326,583.15 KII from wallets on Aug. 22. The attack was repeated 18 times before validators stopped the network at block 9,355,723. The team linked the attack to a Cosmos EVM vulnerability involving vesting accounts, staking operations and balance handling. KiiChain said the attacker bridged part of the assets to BNB Smart Chain through Hyperlane.
TAC separately reported that an attacker exploited a weakness in the Cosmos EVM precompile layer on Aug. 22 and drained one account. Validators halted TAC at block 24,671. Both networks suffered unauthorized asset movements, though Cosmos Labs has not published an aggregate loss calculation.
MANTRA Restarted After 30-Hour Halt
MANTRA stopped its network on Aug. 20 after detecting activity involving two project-managed wallets. The team isolated the incident to its Cosmos EVM module and deployed an updated release before coordinating a validator restart. MANTRA resumed block production after roughly 30 hours, restarting from a snapshot without rolling back the chain's recorded state.
MANTRA said no user funds were affected and that the two affected addresses belonged to its internal wallet infrastructure. However, its complete post-mortem and detailed asset accounting remain unpublished.
Previous Cosmos EVM Flaws
The incidents follow an earlier Cosmos EVM flaw involving the ICS20 precompile. A March security advisory said incorrect state handling during nested execution allowed the same token balance to be used repeatedly within one transaction. That earlier issue caused an estimated $7 million loss on SagaEVM in January.
It remains unconfirmed whether the August attacks used that exact flaw, a related execution path, or a separate vulnerability. Cosmos Labs' promised report should identify the faulty component, affected versions, exploitation timeline and total losses.
What Users Should Do
The immediate priorities are identifying every vulnerable deployment, distributing a tested patch and confirming that affected chains can restart safely. Users should rely on official chain status pages and avoid transactions through unverified interfaces or purported recovery tools, which could be phishing attempts targeting affected communities.
Validators will need coordinated upgrade instructions before resuming block production. Until Cosmos Labs publishes its incident report, other teams using Cosmos EVM may keep networks halted or disable affected functionality.
