The attack on the Cosmos EVM ecosystem turned into a real fiasco for the attacker. He managed to exploit a critical vulnerability and mint Nesa (NES) tokens worth about $50 million, but the actual profit was only $60,000. This is a vivid example of how market liquidity can become the protocol's main defender.
How the attack was carried out and why it failed
My analysis of the transaction chain shows that the hacker acted methodically. The initial wallet 0x9AE7 received $250,000 via Monero (XMR)—an anonymous channel often used to conceal traces. These funds were then converted into NES and moved to the Nesa Chain network, where the attacker used a bug to increase the balance 200-fold.
He then attempted to withdraw about $50 million in NES back to Ethereum, distributing the tokens across eight addresses. On each of them, NES was exchanged for ETH through decentralized exchanges, and the proceeds were sent to centralized platforms. However, his plan cracked here: liquidity in the pools was exhausted faster than he could sell the bulk of the tokens. The slippage proved so devastating that almost nothing remained of the nominal amount.
The final picture looks almost ironic: with costs of $255,000, the hacker received only $315,000, yielding a net profit of about $60,000. Instead of the expected millions—meager percentages of what was planned.
Cosmos Labs' response and the scale of the threat
Cosmos Labs responded promptly to the incident, recommending that all networks using Cosmos EVM versions below v0.6.2 or v0.7.2 immediately halt block validation and install patches. The team has not yet disclosed the details of the vulnerability itself but emphasized that many affected chains have already fixed the issue.
It is known that the attack affected at least four networks on the shared module. In KiiChain, the attacker repeated the exploit 18 times, withdrawing 148,326,583.15 KII. Nesa also confirmed an attempted intrusion through the same hole, and MANTRA and TAC were affected as well. The full picture of the damage, in my estimation, will only become clear after Cosmos Labs publishes a detailed report.
My comment: This case is an important signal for the entire industry. Even a successful exploit can turn out to be unprofitable if the real market depth is not taken into account. But the main takeaway is not that: the vulnerability in the base module used by many networks highlights systemic risks that require not point patches but a revision of architectural security across the Cosmos ecosystem.