Cosmos EVM security incident affects three blockchain networks

Cosmos Labs has confirmed a security incident in its Cosmos EVM module, prompting three blockchain networks—KiiChain, TAC, and MANTRA—to disclose impacts. On August 22, 2026, attackers exploited the vulnerability, draining over 148 million KII from KiiChain and a single account on TAC, forcing both networks to halt block production. MANTRA also halted but has since resumed operations after patching the vulnerability in version 8.4.0.

Cosmos EVM module vulnerability

• ▪Cosmos Labs advised blockchain networks utilizing the Cosmos EVM module to coordinate with validators to halt block production.
• ▪Cosmos Labs directed teams with questions to its security contact and stated it will publish an incident report once the security situation is resolved.
• ▪Cosmos Labs confirmed a security incident affecting users of the Cosmos EVM module, which allows Cosmos SDK chains to run Ethereum-style smart contracts.

KiiChain exploit response

• ▪On August 22, 2026, an attacker exploited the Cosmos EVM module vulnerability 18 times to drain 148,326,583.15 KII from KiiChain.
• ▪KiiChain validators halted block production at block 9355723 following the exploit, and the network remains halted as of August 25, 2026.
• ▪KiiChain plans to resume operations through a coordinated binary upgrade applied simultaneously by all validators at a predetermined block height, without requiring an on-chain governance proposal.

TAC network chain halt

• ▪The TAC network halted block production at block 24,671,475 on August 22, 2026, after an attacker drained a single account using the Cosmos EVM module vulnerability.
• ▪The TAC network team stated that the vulnerability responsible for the exploit resides in the shared Cosmos EVM module rather than in TAC-specific code.

MANTRA mainnet restart

• ▪MANTRA halted its chain as a precaution, reporting that two MANTRA-managed wallets were affected but user balances were not impacted.
• ▪MANTRA resumed normal block production on its mainnet after fixing the Cosmos EVM module vulnerability in version 8.4.0.

Validator coordination process

• ▪Three blockchain networks—KiiChain, TAC, and MANTRA—disclosed security impacts and coordinated with their respective validators to manage the Cosmos EVM module vulnerability.
• ▪The validator-coordinated response to the Cosmos EVM security incident is broader than TAC's May bridge containment, though the project has not disclosed the affected supply or a restart timetable.

2 sources