Cosmos Labs Says a Flaw It Rated Low in March Was Used to Steal Nearly $6 Million Across Six Chains

Cosmos Labs has acknowledged that a defect its engineers triaged as low severity in March was later used to drain funds from six networks that share the same Cosmos EVM module. The total taken is just under $6 million, spread across chains including MANTRA, TAC and KiiChain.

The root cause was an accounting mismatch in the ICS20 precompile, the component that handles token transfers under the Inter-Blockchain Communication (IBC) framework. Under certain nested calls, the transfer executed while the state record showed that no tokens had moved. That gap let an attacker spend the same balance repeatedly. The vector was neither an oracle manipulation nor a stolen key. It was a state-accounting bug in shared infrastructure that many independent chains inherit without auditing it themselves.

The timing is the part the ecosystem is arguing about. An upstream fix reached release branches only hours before the incidents began, and MANTRA halted its chain for roughly 30 hours between August 20 and 22 while emergency patches were applied. MANTRA has valued the tokens taken from it at about $3.6 million using the pre-incident price and says none have been recovered. Analysts tracking the stolen funds estimate roughly $2.87 million was converted through decentralized exchanges and about $2.85 million through centralized venues, which means part of the proceeds passed through platforms that can freeze balances if they choose to act.

Cosmos Labs says it is revising its security triage and disclosure process after learning the true blast radius of the flaw shortly before the attacks. The wider point is structural. A single module maintained by one team sits under many sovereign chains, and the severity rating assigned by that team effectively sets the patch urgency for all of them. The public incident library maintained by DeFiHackLabs, which reconciled its running count past 862 logged incidents this week, continues to fill with cases of this shape.