Security · Analysis
The Chains Learned From the Attacker First
Cosmos Labs decided a critical balance bug was safe to fix quietly. Then a public pull request in a downstream fork spelled out the exploit path, and the clock that mattered started running — for everyone except the operators running the code.
On August 28, Cosmos Labs published a post-mortem on a critical flaw in the shared Cosmos EVM module. Between August 20 and August 25, attackers used it to drain six blockchains of roughly $5.72 million. The document is unusually candid about how the team got there, which is the only reason this story can be told with dates attached.
The bug itself is small and old-fashioned. The advisory, GHSA-7g4w-cg88-2cq2, is titled "Balance underflow in EVM StateDB." When a vesting account delegated more than its immediately spendable balance — legal, because staking is allowed to reach locked funds — the SubBalance write-back subtracted the full delegated amount from the smaller spendable figure. Unsigned integers do not go below zero. They wrap. The balance wrapped to roughly 2256, and from there an attacker could overflow a second account and extract its real balance without ever increasing total token supply. Nothing was minted. The ledger stayed internally consistent while money left it.
Four months, and the wrong test network
The flaw arrived through the bug bounty program on April 25. It was assessed the same day, and the assessment was wrong. Engineers could not reproduce it on 18-decimal networks and concluded it only affected chains using six decimals. Since the production Cosmos EVM chains they knew about ran 18 decimals, they concluded live networks were not exposed.
"We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded" that it affected only non-18-decimal systems, the post-mortem says.
That conclusion drove everything after it. Because the bug was filed as a non-issue for live chains, the fix travelled the ordinary route: pull request #1176, adding an underflow guard to the SubBalance write-back, merged into main on May 15, followed by #1187 on May 20. Public commits, in a public repository, with no advisory attached. The post-mortem's phrasing is that "the team concluded that it would be safe to proceed with the silent patch process."
On August 13 the team confirmed what the April assessment had missed: every Cosmos EVM chain was affected, decimals irrelevant. The guard was backported to the release branches that day. Releases v0.6.2 and v0.7.2 went out on August 19. Per The Hacker News, neither changelog mentioned a security backport, and neither listed the pull requests that carried it.
Eight hours and fifteen minutes
The releases landed late on August 19. At 07:16 UTC on August 20 — eight hours and fifteen minutes later — a public pull request in Push Chain's fork of Cosmos EVM described the vulnerability and its exploitation path in detail.
Eleven hours and fifty minutes after that, at 19:06 UTC, the first attack hit MANTRA.
Cosmos Labs sent its first private notification to chain operators through a secure email channel at 03:36 UTC on August 21 — roughly eight and a half hours after the attacks had already started. Operators running the vulnerable code found out that it was vulnerable after somebody had finished proving it.
KiiChain, one of the chains drained, put the general principle plainly: "Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit."
What moved versus what was made
The headline figures are not measuring the same thing, and it is worth separating them. Cosmos Labs' $5.72 million is realized proceeds — roughly $2.87 million sold on decentralized exchanges and $2.85 million on centralized ones, valued at August 19 prices. The per-chain numbers reported by outlets are nominal: tokens moved, priced at market, most of which was never converted to anything.
Tokens drained vs. money realized
| Chain | Tokens drained | Reported nominal value |
|---|---|---|
| KiiChain | ≈148.3M KII, across 18 transactions | ≈ $9.7M |
| MANTRA | ≈ 720.9M tokens, two managed wallets | ≈ $3.6M |
| TAC | 2,985,651,403 TAC (≈62% of circulating supply) | not disclosed |
| All six chains, realized | sold on DEXs and CEXs | ≈ $5.72M |
On KiiChain, 80.7 million KII — 54.4% of the take — sat in attacker-linked addresses immobilised by the halt. About 64.6 million KII was converted to roughly 1.61 million BUSD on decentralized exchanges, and 3 million was sent to a KuCoin deposit address. That is what a thin-liquidity drain looks like in practice: a large number on the block explorer, a much smaller number at the exit.
The policy Cosmos Labs wrote for itself
The post-mortem quotes the team's own disclosure policy: "When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs."
That policy was not violated by the April decision, exactly — it was routed around by it. The April assessment concluded there was no immediate or network-wide risk, so the emergency track never activated. The failure was not that anyone ignored the rule. It was that a single incorrect reproduction result, recorded in April and not revisited until August, determined which rule applied for the next 110 days.
The advisory itself is a smaller version of the same problem. It carries a Critical rating and no CVE, no CVSS score, and no weakness classification — nothing that an automated dependency scanner keys on. A downstream operator relying on tooling to tell them they were exposed would have been told nothing.
Eleven chains nobody had a phone number for
When the attacks started, Cosmos Labs reached out to about 40 networks. Eleven of them were Cosmos EVM deployments the security team had never heard of — chains running the module with no registration in any channel the maintainers could use to warn them.
Thirteen chains patched or halted before an attacker reached them. That number is the argument for the emergency track working when it is actually switched on.
The recoveries have gone better than the first week suggested. MANTRA halted late on August 20 and resumed producing blocks around 05:30 UTC on August 22. KiiChain halted at block 9,355,723 and TAC at block 24,671,475, both late on August 22. KiiChain has since said it resumed normal block production with the module patched, reporting no user funds lost and the immobilised majority of the drained supply moved to recovery wallets as part of the restart upgrade. Upgrading is state-breaking and requires a coordinated binary upgrade at an agreed block height — which, as KiiChain noted, does not need an on-chain governance vote.
The Take
Silent patching is a real technique with a real justification: publishing an advisory before operators can upgrade tells attackers first. But it only works if the commit is genuinely quiet, and a commit in a public monorepo with downstream forks is not quiet — it is a disclosure with a delay fuse and no one holding the timer. Push Chain's fork did nothing wrong by reading the code and writing about it. That is what forks do. The lesson is narrower and harder than "Cosmos Labs messed up": if your fix ships as a public commit, you have already disclosed, and the only question is who reads it first. The second lesson is about the April assessment. A negative reproduction on one configuration is not proof of safety on the others, and here it was the triage, not the bug, that set the loss. This desk covered a near-identical shape yesterday, when Ledger shipped a silent fix and an outside agent published the same finding ten days later — same technique, and only luck decided which one ended in a drain.