{"id":"nesa-cosmos-evm-token-theft-aug-2026","category":"breach","status":"closed","title":"Nesa chain exploited through Cosmos EVM flaw: about US$50 million of NES moved, attacker's net gain estimated near US$60,000","tldr":"Nesa's blockchain was exploited on 24 Aug 2026 through a Cosmos EVM flaw. About US$50m of NES was moved off-chain, but thin liquidity left the attacker an estimated US$60k. Nesa says it has patched. NES holders should use only the new official contracts.","summary":"On 24 August 2026 an attacker exploited Nesa, a blockchain built on Cosmos EVM, and withdrew about 257.7 million NES tokens (roughly 25.8% of stated supply, worth about US$50 million) to Ethereum. Nesa confirmed exploitation of a Cosmos EVM vulnerability but has not published a post-mortem, the exploit transaction or the victim account. The flaw matches one Cosmos Labs documented, in which delegating locked vesting tokens through the staking precompile makes an account balance wrap to a huge number that is then used to take another account's balance. Cosmos Labs fixed it in v0.6.2 and v0.7.2 on 19 August and did not name Nesa in its post-mortem; applying that mechanism to Nesa is supported by Nesa's statements and bridge records, not shown at transaction level. The attacker sold into thin liquidity and reportedly kept only about US$60,000. Nesa says the chain is fully patched. Its explorer was unusable on 8 September, and no restart date has been published. Binance Alpha planned a 1:1 swap to new NES contracts and resumed trading on 10 September. No recovery, bounty or arrests were reported in anything I read.","action":"If you hold NES, use only the new official contract addresses Nesa announced on 6 September, and follow your exchange's swap instructions. Ignore unsolicited messages offering to swap or restore tokens. Nothing else is needed from other families.","product":"Nesa (NES) blockchain and token, built on Cosmos EVM","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["nesa","nes","cosmos-evm","crypto-theft","bridge","defi","vesting-account","integer-underflow"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Nesan","url":"https://rekt.news/nesa-rekt","by":"Rekt","date":"2026-09-10"},{"kind":"news","title":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack","url":"https://theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061","by":"The Block","date":"2026-08-29"},{"kind":"news","title":"Cosmos EVM Hacker Minted $50 Million — and Walked Away With Just $60,000","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-evm-hacker-minted-50-055017363.html","by":"Yahoo Finance (BeInCrypto)","date":"2026-08-27"}],"started":"2026-08-24","closed":"2026-09-10","created":"2026-11-03T21:31:20.512Z","updated":"2026-11-03T21:31:20.512Z","cve_notes":[],"timeline":[{"at":"2026-09-10","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Binance Alpha planned to resume NES trading on 10 September, with a 1:1 swap for NES held before deposits closed on 24 August. As of 8 September Nesa's public explorer showed no usable data, and no technical post-mortem had been published by Nesa. I found no later reporting.","url":"https://rekt.news/nesa-rekt","by":"Rekt","patch":null},{"at":"2026-09-05","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Nesa issued a follow-up statement calling the attack pre-meditated and saying the chain was fully patched. It gave no technical detail, loss figure or restart date. It announced new official NES contract addresses on Ethereum and BSC the next day.","url":"https://rekt.news/nesa-rekt","by":"Rekt","patch":null},{"at":"2026-08-28","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Cosmos Labs published its post-mortem. It said a researcher reported the flaw on 25 April, that it wrongly judged the risk low after testing only a six-decimal network, and that six chains were hit between 20 and 25 August. It did not name Nesa.","url":"https://theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061","by":"The Block","patch":null},{"at":"2026-08-27","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Reports said the attacker kept little: the stolen NES was sold into thin liquidity with heavy slippage, for an estimated net gain of about US$60,000 (Bubblemaps). The coverage mentioned no recovery of funds, bounty or arrests.","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-evm-hacker-minted-50-055017363.html","by":"Yahoo Finance (BeInCrypto)","patch":null},{"at":"2026-08-24","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"Nesa was exploited through the same Cosmos EVM flaw. The attacker moved about 257.7 million NES, roughly 25.8% of stated supply and worth about US$50 million, from Nesa's chain to Ethereum. Nesa said only that it had identified malicious behaviour and would restore services after a fix. Bitvavo paused NES deposits and withdrawals the same day.","url":"https://rekt.news/nesa-rekt","by":"Rekt","patch":null},{"at":"2026-08-19","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Cosmos Labs released Cosmos EVM v0.6.2 and v0.7.2 with a fix for a balance-accounting flaw, describing it only as important security fixes. The first attacks on other Cosmos EVM chains began about 20 hours later.","url":"https://theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061","by":"The Block","patch":null}],"url":"https://hard.fyi/live/nesa-cosmos-evm-token-theft-aug-2026/","json":"https://hard.fyi/api/live?id=nesa-cosmos-evm-token-theft-aug-2026"}