← The Polylog Crypto Intelligence Brief
Morning Edition · Tuesday, August 25, 2026Published at 1:50 AM EDT · New York
Three Cosmos-Based Chains Halted Block Production After a Double-Spend Bug in Shared Code
The defect sits in a module many Cosmos chains inherit, and a fix has been available since a March advisory that not every network applied.
Cosmos Labs urged chains running the Cosmos Ethereum Virtual Machine (EVM) module to halt after incidents at MANTRA, TAC and KiiChain, with a detailed report still pending. The three networks stopped producing blocks within days of one another, the strongest available signal that the problem lies in code they share rather than in any one team's contracts.
The underlying defect is in the token-transfer precompile that bridges Cosmos inter-chain transfers into EVM execution. State changes made during recursive calls were not reflected in the outer execution context, which allowed the same token balance to be spent more than once inside a single transaction. That is a classic re-entrancy failure expressed through a state-isolation gap rather than a contract callback. The issue is tracked as advisory ASA-2026-002, and reporting attributes an earlier exploitation of the same class against Saga's EVM network in January, for roughly $7 million.
The three incidents differ in impact. MANTRA halted its mainnet on 21 August and restarted about 30 hours later after deploying version 8.4.0, saying the incident touched two chain-managed wallets and not user balances, and blaming an upstream software dependency. TAC said it was investigating an exploited vulnerability on the Cosmos-based EVM side affecting its own token supply and coordinated a validator halt, with its connection to The Open Network offline during the stop. KiiChain said an attacker moved funds out through the Hyperlane bridge onto BNB Smart Chain and halted the network as a precaution. Loss figures for TAC and KiiChain have not been disclosed.
Cosmos Labs identified affected chains earlier this year and coordinated mitigation with several teams, which makes the August cluster look like a patch-adoption problem rather than new attacker research. Shared modules give small chains the security engineering of a large ecosystem only when they actually upgrade. Security publications including Rekt have documented the same pattern repeatedly across bridge and validator infrastructure.
Veracity: Corroborated
86/100Part of a tracked trend
Unaudited Open-Source Crypto Code Surfaces at Scale
Coordinated volunteer and AI-assisted review keeps exposing large backlogs of undiscovered defects in the open-source libraries that wallets, nodes and protocols depend on, so disclosure waves — not novel attacker research — become a recurring driver of emergency patches and incident risk across the ecosystem.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Aztec Says a Soundness Flaw in Its Proving System Puts Funds on Its Live Privacy Network at Risk
- Ledger Patched a Flaw That Could Have Made Its Ethereum App Sign a Transaction Different From the One Displayed
- Ethereum Proposal Would Retire the Sync Committee and Cut About 33,800 ETH of Annual Issuance
- Bitcoin Trades Above $80,000 for the First Time Since May After the Treasury Doubled Its Bond Buybacks
- Coinbase Put Tokenized Apple, Nvidia, Meta and Alphabet Shares on Its Base Network
- US Treasury Names Digital Assets Among Five Iranian Sectors Exposed to New Sanctions
- Solana Validators Vote on Slowing New SOL Creation and Raising Daily Token Burns
Comments
1Aug 26, 5:04 AM · edited
Any Cosmos chain running the unpatched EVM module and not yet halted remains exploitable by the same transaction pattern, making the current incident list a lower bound rather than a complete count.