Cosmos Labs Admits Security Error Led to $5.7 Million Multi-Chain Exploit

Cosmos software flaw leads to multi-chain thefts

Attackers stole approximately $5.7 million from six different blockchain networks between August 20 and August 25. A blockchain is a digital ledger that records transactions across a network of computers. The hackers used a flaw in Cosmos EVM, which is shared software that allows these networks to run applications similar to those on the Ethereum network.

Cosmos Labs admitted in a technical report that they had been warned about this bug in April. However, they initially believed the flaw did not pose a risk to live networks and did not issue a public warning at that time. The stolen funds were sold through both decentralized and centralized exchanges, which are platforms where users trade digital assets.

Significant details of the exploit

• Six different blockchains were affected by the security breach.
• The attackers laundered $2.87 million through decentralized exchanges and $2.85 million through centralized exchanges.
• A researcher first reported the vulnerability on April 25, nearly four months before the attacks began.
• The bug involved a mathematical error called "integer underflow," which allowed wallets to display massive, incorrect balances.

Official findings from Cosmos Labs

Cosmos Labs explained that their initial tests failed to reproduce the attack on live network configurations. Because of this, they chose a "silent patch" process to fix the code in May without alerting the public. They only realized all Cosmos EVM chains were vulnerable after receiving new reports from independent researchers in early August.

A fix was eventually released on August 19, but it did not explicitly describe the bug it was fixing. Cosmos Labs also noted that a developer from another project publicly shared the exact method for the exploit about 12 hours before the first theft occurred, which likely increased the risk of an attack.

Impact on specific blockchain networks

MANTRA Chain reported losing $3.6 million in its own report. The project criticized the timeline of the fix, stating that a 20-hour window between the patch release and the first attack was not enough time for independent networks to update their systems. MANTRA noted that the hackers targeted a "burn address"—a digital wallet used to permanently remove tokens from circulation—because it was not monitored for outgoing transfers.

Other victims included TAC, which lost about $950,000, and KiiChain, which saw $1.6 million worth of its tokens sold. Blockchain analysts also identified a project called Nesa as a victim. While the attacker moved $50 million worth of Nesa tokens, they only made about $60,000 in profit because there was not enough liquidity to sell the tokens without crashing the price.

What is confirmed

It is confirmed that a critical bug existed in the Cosmos EVM software and was exploited to drain funds from at least six chains. Authorities have frozen the attacker's accounts on centralized exchanges as part of an ongoing investigation. No new tokens were created during the hack; instead, the attacker used the mathematical flaw to move existing tokens from large accounts and burn addresses into their own wallets.

Why this matters for the crypto ecosystem

This event highlights the risks associated with shared software code in the crypto industry. When multiple blockchains rely on the same underlying technology, a single bug can put many different networks at risk. It also raises concerns about how security teams disclose vulnerabilities, as delayed or silent patches may not give network operators enough time to protect user funds.

Sources

• The Block