← The Polylog Crypto Intelligence Brief
Morning Edition · Friday, September 11, 2026Published at 1:49 AM EDT · New York
One Cosmos EVM Flaw Drained Four Chains, and the Patch Shipped Without an Advisory
Attackers hit MANTRA, TAC, KiiChain and Nesa between 20 and 25 August using the same module defect that Cosmos Labs had received in April and fixed quietly.
A single defect in the shared Cosmos EVM (Ethereum Virtual Machine) module, reported to sit in the token-transfer precompile (a built-in shortcut function coded directly into the blockchain software) and in how the module handles vesting accounts, staking operations and balances, produced four separate chain drains in six days. Rekt News has now documented the cluster: MANTRA lost 720.9 million tokens worth roughly $3.6 million, KiiChain saw 148.3 million KII bridged out through Hyperlane to BNB Smart Chain across 18 transactions, TAC froze its chain, and on 24 August an attacker moved 257,703,733 NES, about a quarter of Nesa's stated supply, across Hyperlane to Ethereum.
The disclosure sequence is the contested part. Cosmos Labs received the vulnerability report in April, concluded that production networks were not at risk, and handled the fix through a silent patch. The first attack began roughly 20 hours after the patched versions shipped without a vulnerability-specific advisory to network operators. Silent patching protects unupgraded chains from opportunistic attackers reading the commit log. It also leaves operators unaware that upgrading is urgent.
Smaller incidents this week landed in the DeFiHackLabs reproduction repository. Contributors published proofs of concept for Ajna Finance's liquidation accounting manipulation, which drained about $775,000 from seven Ethereum pools in an immutable protocol with no treasury to reimburse anyone, for an Enso Finance vault that priced a deposit off a mis-set Uniswap V3 observation window close to spot, and for arbitrary call injection through an unverified call in the Unistreet launchpad.
Veracity: Corroborated
86/100- If true, who benefits
The affected chains, for whom a maintainer-disclosure failure explains losses better than their own upgrade practices, and security researchers arguing for mandatory severity advisories.
Part of a tracked trend
Bridge and Mint Exploits Sustain Heavy DeFi Losses
Over 3-6 months, recurring bridge proof-validation and unauthorized-mint exploits keep monthly DeFi losses elevated, including drains of deprecated contracts.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Senate Republicans Rewrite the Clarity Act's DeFi Rules Four Days Before a 60-Vote Test
- Aztec Says a Flaw in Its Alpha V5 Proving System Could Let an Invalid Transaction Pass Verification
- A 55-Character String Cut One XRP Wallet's Key Space to 2 to the 46th, and the Project Is Closing
- India Puts Corporate Bonds on a Distributed Ledger and Settles Them in Wholesale Digital Rupees
- Miden Frames Confidential Stablecoins as the Core Product, Not a Privacy Feature
- Coinbase Puts Stablecoin Rails Inside 1,000 Community Banks Through Moov
- Bitcoin Trades Below $77,000 as Futures Price a September Federal Reserve Rate Increase
Comments
0No comments yet.