Cosmos EVM Security Crisis: KiiChain and TAC Attacks Prompt Operation Halts
Multiple blockchain networks face security vulnerabilities as Cosmos Labs issues urgent suspension calls.
1Emergency Suspension Call
Cosmos Labs urged affected networks to halt operations due to a security flaw in the EVM module. KiiChain, TAC, and MANTRA attributed recent attacks to bugs in Cosmos EVM infrastructure. The company hasn't clarified whether incidents stem from a single flaw or which networks received specific suspension instructions. Cosmos Labs promised a detailed incident report once the situation is resolved.
2Major KiiChain Exploit
On August 22, an attacker drained 148 million KII tokens from KiiChain using the same technique across 18 targets. The chain halted at block 9,355,723, preventing further theft and freezing remaining funds. KiiChain identified the vulnerability in the shared Cosmos EVM module, not its own code. Three upstream defects combined enabled the attack: a staking precompile underflow and two other undisclosed bugs.
3Security Update Failure
A patch for one of three flaws was released on August 19, but KiiChain noted affected networks weren't pre-warned, and the update wasn't marked as critical. When communicated two days later, the fix bundled with unrelated issues lacked suspension recommendations. During this delay, MANTRA was exploited. KiiChain emphasized emergency halts provide faster risk containment than software updates requiring validator coordination.
4TAC Token Transfer
On the same day, an attacker exploited a Cosmos EVM precompile layer vulnerability to transfer 2.98 billion TAC tokens from a single account. TAC halted its chain to stop the attack, confirming the bug wasn't in chain-specific code. Only TAC tokens were affected, with other assets remaining secure. Total supply remained unchanged with no new tokens created.
5MANTRA's Precaution
MANTRA preemptively halted its Layer 1 network for 30 hours last week. The project later confirmed identifying the root cause, containing the immediate threat with no user funds compromised. Two wallet addresses were affected before a patch was deployed. MANTRA acknowledged being vulnerable to the same class of exploit as KiiChain.
6Industry Implications
These incidents reveal risks for Cosmos EVM chains with enabled vesting accounts. Security experts emphasize critical importance of auditing shared components in modular blockchain architectures. Such vulnerabilities risk eroding trust among crypto exchanges and investors, potentially impacting market stability and adoption rates across interoperable networks.
7Governance Shortcomings
KiiChain's disclosures highlight critical gaps in security update communications. Failure to separately flag urgent patches and lack of cross-chain coordination facilitated attack proliferation. The events underscore the need for standardized security incident protocols across blockchain ecosystems, particularly for shared infrastructure components.
8Blockchain Security Lessons
These attacks underscore risks in shared codebases across EVM-compatible chains. Researchers stress modular blockchain projects must invest more in component security. Developing emergency response protocols, cross-chain communication channels, and automated alert systems emerge as pressing needs following these coordinated exploits.