Cosmos Labs faces backlash over disclosure of bug affecting four blockchains

Cosmos Labs is facing severe backlash from the crypto security community after its 'silent patch' of a bug in the Cosmos EVM module led to exploits on multiple blockchains. On August 22, 2026, attackers drained $9 million from KiiChain and $7.5 million from the TAC network. Critics and affected projects, including KiiChain, blamed Cosmos Labs for publishing the security fix openly before privately notifying the affected networks, calling the losses avoidable.

Cosmos EVM module vulnerability

• ▪Prior to Cosmos Labs' warning, the MANTRA and Nesa networks had already advised of chain halts, with no user funds reportedly affected.
• ▪A bug in the Cosmos EVM module developed by Cosmos Labs affected four blockchain networks: MANTRA, TAC, KiiChain, and Nesa.
• ▪Cosmos Labs advised validators of affected Cosmos EVM networks to halt their chains in a warning issued on August 24, 2026.

Silent patch disclosure policy

• ▪Cosmos Labs' original disclosure of the bug aligned with its 'silent patch model' policy, which did not include a warning on its official X account.
• ▪Cosmos Labs quietly patched the Cosmos EVM module bug in a release during the week prior to August 25, 2026, recommending a coordinated upgrade.

KiiChain exploit losses

• ▪KiiChain published a post-mortem report blaming Cosmos Labs' disclosure process, calling the exploit avoidable because the security fix was published openly before chains were privately notified.
• ▪On August 22, 2026, attackers drained nearly 150 million KII tokens, worth over $9 million, from KiiChain wallets.
• ▪Attackers who drained KiiChain wallets on August 22, 2026, sold the stolen KII tokens for $1.6 million in BUSD, briefly crashing the token's price.

TAC network token drain

• ▪On August 22, 2026, the Telegram-focused TAC network had three billion TAC tokens, valued at approximately $7.5 million, drained from its staking contract.
• ▪In January 2026, another Cosmos EVM network, Saga EVM, lost approximately $7 million in a separate exploit.

Security community criticism

• ▪KiiChain's post-mortem report cited a lack of advance notice, a failure to flag the update as critical, and delayed communication from Cosmos Labs as contributing factors to its exploit.
• ▪Cosmos Labs faced backlash from the crypto security community, with some members labeling the original disclosure of the Cosmos EVM module bug as negligent.

1 source