# One Shared Cosmos Library Bug Drained Four Chains, and Bots Are Now Probing Bitcoin Payment Servers

A defect in the shared Cosmos EVM module let attackers inflate balances on Nesa, KiiChain, TAC and MANTRA, while BTCPay Server released version 2.4.4 to close an administrative path bots are actively scanning for.

- Published: 2026-09-14T05:49:22.021Z
- Canonical: https://polylog.news/crypto/2026-09-14/one-shared-cosmos-library-bug-drained-four-chains-and-bots-a
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News](https://www.rekt.news/), [CryptoSlate](https://cryptoslate.com/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c1dab229cec5c98497357321b81d94aeda1acc27), [The Block](https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061)

The incidents catalogued on rekt.news under the names Nesa, KiiChain, TAC and MANTRA share one root cause: a defect in the Cosmos EVM module that several chains inherit as a dependency. The attacker on Nesa bought roughly $250,000 of the NE…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-09-14/one-shared-cosmos-library-bug-drained-four-chains-and-bots-a (subscription information: https://polylog.news/pricing).