# One Cosmos EVM Flaw Drained Four Chains, and the Patch Shipped Without an Advisory

Attackers hit MANTRA, TAC, KiiChain and Nesa between 20 and 25 August using the same module defect that Cosmos Labs had received in April and fixed quietly.

- Published: 2026-09-11T05:49:36.633Z
- Canonical: https://polylog.news/crypto/2026-09-11/one-cosmos-evm-flaw-drained-four-chains-and-the-patch-shippe
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News (Nesan)](https://www.rekt.news/), [Rekt News (Mantra)](https://www.rekt.news/), [Rekt News (Total Exposure)](https://www.rekt.news/), [DeFiHackLabs (Ajna)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fe55c9f846cf1020b18be2e5c3ecba560606f073), [DeFiHackLabs (Enso)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fb6f9781db9ce477f1caed93369e63e7cb46a88c), [DeFiHackLabs (Unistreet)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/06b3631f1f184bbc2086683cc1a8770a6ed22104</source_url)

A single defect in the shared Cosmos EVM (Ethereum Virtual Machine) module, reported to sit in the token-transfer precompile (a built-in shortcut function coded directly into the blockchain software) and in how the module handles vesting accounts, staking operations and balances, produced four separate chain drains in six days. [Rekt News has now documented the cluster](https://www.rekt.news/): MANTRA lost 720.9 million tokens worth roughly $3.6 million, KiiChain saw 148.3 million KII bridged out through Hyperlane to BNB Smart Chain across 18 transactions, TAC froze its chain, and on 24 August an attacker moved 257,703,733 NES, about a quarter of Nesa's stated supply, across Hyperlane to Ethereum.

The disclosure sequence is the contested part. Cosmos Labs received the vulnerability report in April, concluded that production networks were not at risk, and handled the fix through a silent patch. The first attack began roughly 20 hours after the patched versions shipped without a vulnerability-specific advisory to network operators. Silent patching protects unupgraded chains from opportunistic attackers reading the commit log. It also leaves operators unaware that upgrading is urgent.

Smaller incidents this week landed in the DeFiHackLabs reproduction repository. Contributors published proofs of concept for [Ajna Finance's liquidation accounting manipulation](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fe55c9f846cf1020b18be2e5c3ecba560606f073), which drained about $775,000 from seven Ethereum pools in an immutable protocol with no treasury to reimburse anyone, for [an Enso Finance vault that priced a deposit off a mis-set Uniswap V3 observation window](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/fb6f9781db9ce477f1caed93369e63e7cb46a88c) close to spot, and for [arbitrary call injection through an unverified call in the Unistreet launchpad](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/06b3631f1f184bbc2086683cc1a8770a6ed22104).

## What this means

Shared middleware turns one bug into a multi-chain incident, and the appchain model concentrates that risk rather than spreading it. Holders of tokens on small Cosmos EVM networks are exposed through bridge routes, because attackers convert stolen supply into liquid assets on Ethereum and BNB Smart Chain before the source chain can halt. The disclosure question now facing framework maintainers is whether a silent patch without an operator advisory is defensible when downstream teams cannot tell an urgent release from a routine one. Ajna is the cleaner lesson for depositors: immutability removes governance risk and also removes any mechanism to make users whole.

## What to watch

- Whether Cosmos Labs changes its policy and issues explicit severity advisories to chain operators alongside patches.
- Whether the affected chains restore full service and publish loss accounting, since KiiChain, TAC and Nesa have been degraded for weeks.
- Whether bridges such as Hyperlane add exit controls for sudden supply movements from halted chains, which is where stolen appchain tokens are converted into assets that can be sold.