An exploit in the Cosmos EVM ecosystem turned into a loud fiasco for the attacker. He managed to generate Nesa (NES) tokens worth about $50 million, but the actual profit was only $60,000. This is a striking example of how market liquidity can become the main barrier for a hacker.
My analysis of the transaction chain shows that the attack began with wallet 0x9AE7, where funds arrived via Monero (XMR)—a standard tool for concealing traces. The attacker purchased NES for $250,000 and transferred them to the Nesa Chain network. Using a critical vulnerability, he increased the balance 200-fold, then sent about $50 million in NES back to the Ethereum network.
Then the most interesting part began. The tokens passed through eight addresses, where attempts were made to swap them for ETH via decentralized exchanges. However, liquidity in the pools dried up faster than the hacker could realize the entire volume. Slippage turned out to be so catastrophic that almost nothing remained of the nominal amount. In the end, the attacker only netted $315,000 against costs of $255,000—a net profit of a laughable $60,000.
Cosmos Labs' response and the scale of the threat
Cosmos Labs responded promptly to the incident, recommending that all connected networks immediately halt block validation. The official statement emphasizes: "Many affected chains have already fixed the issue. We continue to provide information on remediating the vulnerability. For chains using Cosmos EVM versions below v0.6.2 or v0.7.2, it is recommended to immediately stop the network and update it with the patches from these releases."
As of now, the team has not disclosed details of the vulnerability itself, named the affected networks, or assessed the total damage. It is known that the attack affected at least four networks running on the shared module. In KiiChain, the attacker repeated the attack 18 times, withdrawing 148,326,583.15 KII. Nesa developers also confirmed an attempted hack through the same hole in Cosmos EVM on their Layer 1. MANTRA and TAC were also affected.
This incident is a wake-up call for the entire Cosmos ecosystem. The modular architecture, which provides flexibility and development speed, simultaneously creates vectors for mass attacks. While Cosmos Labs prepares a detailed report, one thing is clear: the security of shared modules must become priority number one, otherwise such "failed" attacks could bring attackers much more in the future.
My conclusion: The hacker underestimated market depth, but this is no reason for complacency. The vulnerability is critical, and if liquidity had been higher, the damage could have amounted to tens of millions of dollars. Projects on Cosmos EVM should immediately conduct an audit and update before it's too late.