The attack on the Cosmos EVM ecosystem turned into an unexpected fiasco for the attacker. Despite successfully minting Nesa (NES) tokens worth about $50 million, the hacker managed to convert only a paltry $60,000 into real funds. This is a vivid example of how market liquidity can become the protocol's main defender.
My analysis of the transaction chain shows that the attack was carefully planned. The attacker, operating through the anonymous wallet 0x9AE7, purchased NES for $250,000 using Monero (XMR) to completely conceal their tracks. Then, exploiting a critical vulnerability in the Cosmos EVM module, they increased their balance 200-fold, creating tokens worth $50 million and transferring them to the Ethereum network.
However, this is where things get interesting. Instead of crashing the market all at once, the hacker attempted to distribute sales across eight different addresses using decentralized exchanges. But the liquidity depth in the pools turned out to be catastrophically insufficient. The slippage was so severe that it practically wiped out the entire amount. In the end, with costs of $255,000, the criminal managed to net only $315,000—a pure profit of a laughable $60,000.
Scope of the problem and Cosmos Labs' response
Cosmos Labs responded promptly to the incident, recommending that all networks using vulnerable module versions (below v0.6.2 and v0.7.2) immediately halt block validation and install patches. The vulnerability affected at least four networks: besides Nesa, KiiChain, MANTRA, and TAC were also impacted. On KiiChain, the hacker repeated the attack 18 times, draining over 148 million KII tokens.
Notably, Cosmos Labs has not yet disclosed the technical details of the vulnerability or assessed the total damage, promising to publish a full report after mitigating the consequences. This suggests the problem may be deeper than it appears at first glance.
My conclusion: This case is an excellent lesson for the entire industry. It demonstrates that even the most sophisticated attack can fail due to a simple lack of liquidity. But don't be fooled: hackers adapt quickly. Next time, they might choose a less liquid but more valuable asset or use complex cross-chain bridge schemes. Protocols need not only to patch their code but also to simulate attack scenarios considering market conditions; otherwise, the next attempt could be far more successful.