Three networks took the hit from one shared codebase, and the fix that should have stopped it sat in a public repository for two days before Cosmos Labs bothered to flag it as critical.
I've seen supply-chain attacks before. This one writes itself.
The Attack Vector
The bug isn't glamorous. It's worse than glamorous — it's boring, and boring bugs are the ones that actually ship. KiiChain's published breakdown traces the exploit to a trio of defects in the staking precompilation function's interaction with EVM balance handling. The overflow error let an attacker deploy a contract at a pre-calculated address, convert that contract into a vesting account, and delegate one wei beyond the available balance. The math returned an incorrect value, which the contract then accepted as authorization to withdraw real funds from targeted wallets. Eighteen times. Across eighteen wallets.
The total token supply didn't increase. The attacker didn't need it to. They were draining value, not minting it — a subtle distinction that matters when you trace the funds. From KiiChain alone, around 148 million tokens left the affected wallets. About 80.7 million were frozen once the network halted; the remaining 67.6 million hopped across Hyperlane into BNB Smart Chain, where roughly 64.6 million were swapped on a DEX for the $1.61 million figure, and 3 million landed in a KuCoin deposit address.
TAC reported the full 2.99 billion TAC movement and stopped block production. Mantra, the third victim, said the attack touched two wallets it managed directly — user, exchange, and partner funds untouched — and resumed operations on a patched build. TAC and KiiChain remain halted as I write this.
The Disclosure Failure
Here's where the cynicism earns its keep. Cosmos Labs pushed the patch to its public repository on August 19. KiiChain's team says they received no advance notice that the release was a security fix — no "critical" tag, no email to dependent chains, no coordinated disclosure window, just code on a branch and silence. The formal warning to halt and upgrade came two days after attacks had already started landing.
That sequence is the whole story. A vulnerability sitting in plain sight while downstream protocols run unpatched is a privilege escalation gift basket. The community noticed. "And you weren't in a hurry. Everything is in complete disarray," one user posted under Cosmos Labs' update — a reaction I'm filing alongside every other "we take security seriously" statement the team has issued this year.
This is the second major Cosmos EVM security incident in 2026. The exact count of chains running vulnerable versions below v0.6.2 or v0.7.2 hasn't been disclosed, and per KiiChain's report the underlying bugs may not be fully squashed even after the current patch. A single release covering the surface isn't the same as a release covering the root cause. If you operate a chain on Cosmos EVM and haven't halted to verify your version, you are the next entry in this post-mortem. And if your incident response plan is the lite version of a security update, you don't have an incident response plan.