Cosmos misjudged a critical bug for 4 months before hackers stole nearly $6 million across 6 chains