Cosmos Labs is facing criticism from the crypto security community following its disclosure of a software bug in the Cosmos EVM module. The vulnerability has affected four different blockchain networks: MANTRA, TAC, KiiChain, and Nesa.
The module's developer quietly patched the issue and ultimately advised validators of affected networks to halt their chains. While release notes recommended that all chains upgrade to the patch release, critics pointed out that there was no initial warning posted on Cosmos Labs' official X account regarding the critical nature of the update.
Ahead of Cosmos Labs' warning, MANTRA and Nesa advised of chain halts with no user funds reportedly affected. However, KiiChain and the TAC network suffered significant exploits.
On August 22, KiiChain wallets experienced a drain of nearly 150 million KII tokens. Although theoretically valued at over $9 million at the time, the drained tokens were dumped for $1.6 million of BUSD, temporarily crashing the token's price. In a post-mortem report shared on X, KiiChain criticized the handling of the situation, calling the loss avoidable and blaming Cosmos Labs' disclosure process for publishing a fix in the open before affected networks could privately patch.
On the same day, the TAC network suffered a drain of three billion TAC tokens valued at approximately $7.5 million from its staking contract. Another network, Saga EVM, previously lost approximately $7 million in January.
