Cosmos Labs has urged affected networks in contact with its team to halt operations amid an ongoing security incident involving the EVM module. Statements issued by KiiChain, TAC, and MANTRA pointed to flaws within the Cosmos EVM infrastructure following attacks, though Cosmos Labs has not yet established publicly whether the incidents stemmed from a common flaw or clarified which networks were specifically instructed to suspend operations.
Cosmos Labs stated it will publish an incident report once the situation is resolved. Meanwhile, KiiChain reported that an attacker drained 148,326,583.15 KII from wallets on August 22, repeating the same technique 18 times against different targets. KiiChain detected the activity internally and halted at block 9,355,723, stopping further theft and freezing remaining funds. According to KiiChain, the vulnerability resided in the shared Cosmos EVM module rather than network-specific code, driven by three upstream defects including an underflow in the staking precompile and two undisclosed bugs.
KiiChain noted that the vulnerability affected Cosmos EVM chains with vesting accounts enabled and linked it to the compromises of MANTRA and TAC during the same week. Criticism has arisen regarding the handling of the vulnerability, as a security fix for one of the flaws was made public on August 19 without advance notice or a critical security flag to affected networks. KiiChain stated that an emergency halt could have contained the risk faster than a software upgrade.
TAC reported that an attacker exploited a vulnerability in the Cosmos EVM precompile layer on the same day, draining a single account and moving 2,985,651,403 TAC between accounts without altering the total token supply. TAC was halted to stop the attack, and only TAC was affected while other assets remained intact.
MANTRA also halted its Layer 1 network as a precaution for about 30 hours. The project later stated it identified the root cause, contained the immediate threat, and confirmed that no user funds were exploited, with operations resuming after a patch was deployed.
