The Cosmos ecosystem has faced a serious challenge: an attack on the Cosmos EVM module has been confirmed, forcing three networks to halt operations simultaneously. This is not a routine incident but a systemic problem affecting the fundamental infrastructure layer, raising questions about the security of projects built on the Cosmos SDK.
Timeline of the incident: from MANTRA to KiiChain and TAC
The MANTRA team raised the alarm first, temporarily freezing its main chain, citing a vulnerability "in one of the dependencies." Later, it became clear that the issue lay precisely in the Cosmos EVM module, which allows running Ethereum-type smart contracts in networks based on the Cosmos SDK. After an emergency update to version 8.4.0, the MANTRA network was restored, and user funds, according to developers, remained untouched — only two wallets controlled by the team itself were affected.
However, this was just the beginning. On the same day, August 22, the KiiChain network came under attack. The attacker exploited the same vulnerability 18 times in a row, managing to withdraw over 148.32 million KII tokens before validators halted the chain at block 9,355,723. The KiiChain team emphasized that the problem was not in their code but in the shared Cosmos EVM module (cosmos/evm), which is used without modifications. The network has not yet been restored — a restart is planned through a coordinated binary code update at a pre-selected block, without on-chain governance voting.
In parallel, the TAC network also halted operations at block 24,671,475 after an attacker drained one account. The TAC team confirmed that the vulnerability lies in the shared module, not in their own implementation.
Cosmos Labs' response and outlook
Cosmos Labs redirected all questions to its security specialist and promised to publish a detailed report once the situation is resolved. The causes of the attack have not yet been disclosed, adding to the uncertainty. This incident is a stark reminder that even mature ecosystems with a strong emphasis on modularity are vulnerable to errors in shared components.
My analysis: The situation underscores the critical importance of auditing not only one's own code but also all dependencies, especially in modular blockchain frameworks. The fact that the vulnerability was discovered simultaneously across multiple networks points to its deep-seated nature and the potential scalability of the threat. Investors and developers should reconsider their security protocols and consider more thorough testing of shared modules before deploying them in production. Restoring trust in Cosmos EVM will require not only a technical fix but also a transparent report on the root causes of the incident.