$5.7 Million Loss Across Six Chains: Patch Released Roughly 20 Hours Before Initial Attack
A vulnerability in the shared software of Cosmos networks led to the theft of tokens worth approximately $5.7 million from six blockchains between August 20-25.
The exploit in Cosmos Labs’ shared software allowed attackers to drain large balances across different networks. MANTRA suffered the largest loss in the incident, at approximately $3.6 million, while the network remained offline for more than 30 hours following the attack.
According to a Cosmos Labs investigation reported by The Block, the vulnerability was reported to the bug bounty program by a researcher on April 25. However, the company’s tests showed that the attack could not be replicated on live Cosmos networks. Consequently, it was believed that funds were not at risk, and a fix was prepared through a process that did not disclose the details of the vulnerability to chain operators.
Patch Released Only 20 Hours Before the Attack
The fix was released on August 19 at 7:01 PM. The first attack began approximately 20 hours later, on August 20. MANTRA stated that this time was insufficient to evaluate, test, and implement the security update on a network with 38 validators. MANTRA also criticized the lack of a warning specifying which vulnerability the patch addressed.
The vulnerability was identified in the Cosmos EVM software, which runs Ethereum-compatible applications on Cosmos networks. Through a calculation error that caused balances to drop below zero, the exploit effectively granted attackers unlimited token balances in their wallets; attackers then transferred these inflated balances to target accounts to seize actual tokens. While the total supply remained unchanged, assets in the target wallets fell under the attackers’ control.
TAC and KiiChain were also among those that suffered losses. Approximately 3 billion tokens were taken from TAC, and 148 million KII from KiiChain. The critical security warning covers Cosmos EVM versions prior to v0.6.2 and v0.7.2.