NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksClosedUpdated

Cosmos EVM balance flaw exploited to drain six blockchains, including MANTRA, TAC and KiiChain

Attackers used a flaw in the shared Cosmos EVM code to steal tokens from six blockchains between 20 and 25 August. Fixes are out (v0.6.2, v0.7.2). Chain operators must apply them. Holders of MANTRA, TAC or KII tokens should follow their chain's official channels.

What to do

If you hold MANTRA, TAC or KII tokens, follow the chain's official channels before moving funds, as TAC and KiiChain were halted. Anyone running a Cosmos EVM chain should upgrade to v0.6.2 or v0.7.2 or later.

What’s happening

Between 20 and 25 August 2026, attackers exploited a flaw in Cosmos EVM, the shared code that lets Cosmos-based blockchains run Ethereum-style contracts. Six networks were hit. Cosmos Labs named MANTRA, TAC and KiiChain and did not name the other three. The flaw let an attacker inflate an account balance and then drain a victim account. Cosmos Labs had received a report in April and first judged it would not cause fund loss on live chains. Fixed versions v0.6.2 and v0.7.2 came out on 19 August, the day before the first attack. Cosmos Labs estimates the attackers sold tokens for about US$2.87 million on decentralised exchanges and US$2.85 million on centralised exchanges, where their accounts were reported frozen. BlockSec puts the loss at about US$14.8 million across the three named chains. MANTRA halted and resumed on a patched version. TAC and KiiChain halted. The sources read do not confirm that they have resumed. No recovered funds have been confirmed. Nesa, which has its own HARD record, was hit through the same flaw, but one report says Cosmos Labs did not count it among the six.

What
Flaw
Affects
Cosmos EVM module (MANTRA, TAC Chain, KiiChain and three other blockchains)
Affected
Cosmos EVM versions below v0.6.2 (0.6.x line) and below v0.7.2 (0.7.x line)
Fixed in
Cosmos EVM v0.6.2
Cosmos EVM v0.7.2
MANTRA hotfix v0.6.0-v8-mantra-6 (MANTRA v8.4.0)
Since
20 Aug 2026
Closed
31 Aug 2026

Timeline

  1. Update

    BlockSec's later newsletter described the bug and put combined losses across the three named chains at about US$14.8 million, a higher figure than the post-mortem's.

  2. Update

    Cosmos Labs published its post-mortem: about US$2.87 million was sold on decentralised exchanges and about US$2.85 million on centralised exchanges. No recovered funds were confirmed.

  3. Update

    The attack window ended with six chains exploited in total. Cosmos Labs coordinated with 40 chains, and exchange accounts used by the attackers were reported frozen.

  4. Wider attacks

    TAC was attacked, then KiiChain about an hour later. KiiChain halted at 22:50 UTC and TAC at 23:58 UTC. MANTRA resumed on v8.4.0 earlier that day.

  5. Wider attacks

    MANTRA was attacked twice on 20 August and halted at 23:13 UTC. A public pull request on another chain had described the attack path that morning, before the first attack.

  6. New fixPartly fixed

    Cosmos EVM v0.6.2 and v0.7.2 were published with the fix.

  7. UpdateNo fix yet

    A fix was merged into the main code branch through Cosmos Labs' quiet patch process. Later reports from independent researchers showed all chains were affected regardless of decimal setup.

  8. Made publicNo fix yet

    Cosmos Labs received a bug bounty report on the balance flaw. It first judged that the flaw would not cause fund loss on production chain configurations.

Sources

  1. Cosmos EVM GHSA-7g4w-cg88-2cq2 post-mortemCosmos Labs · 28 Aug 2026
  2. DeFi security incidents: Cosmos EVM and MoonwellBlockSec · 31 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS