The Cosmos EVM attack: why halting the chain became part of the defense
We at Crouton Digital run validator infrastructure across the Cosmos ecosystem, so this incident deserves a closer look. What matters here is not only how the vulnerability worked, but how the networks responded once the attack began.
Between August 20 and 25, attackers hit six Cosmos-based chains through a flaw in the shared Cosmos EVM module. Around $5.7M in assets were sold off through DEXs and CEXs. No private keys were compromised.
🟢 The bug let an attacker inflate an EVM balance through a vesting account, then use it to zero out another account and walk away with that account's real tokens. It all happened inside a single supply-neutral transaction, so the chain's total supply never moved.
🟢 The fix landed on the main branch back on May 15 and shipped in
v0.6.2 and v0.7.2 on August 19. But on the morning of August 20, a Push Chain developer publicly posted a detailed write-up of the vulnerability and how to exploit it.About twelve hours later, the first attack hit MANTRA.
The catch: this was not a routine rolling upgrade. The change touched how balances are calculated, so the whole network had to move to the new version in a coordinated way.
MANTRA has 38 independent validators. In 20 hours, an upgrade like that had to be prepared, tested and rolled out in sync.
🟢 In the middle of the crisis, chains started halting block production.
⏺️ MANTRA stopped 14 minutes after the second attack
⏺️ KiiChain stopped after 18 repetitions of the exploit, and more than half (~54%) of the drained KII stayed on the chain
⏺️ TAC halted about 4 hours after being hit, having already received the upgrade notice
In total, Cosmos Labs coordinated with roughly 40 chains. Another 13 potentially exposed networks closed the gap with no further incidents, and one more halted before any funds left.
After the second confirmed incident, Cosmos Labs was already telling chains to halt immediately rather than attempt a coordinated upgrade on the fly. Going forward, the team has committed to formalizing when a halt, the kill switch, should take priority over an upgrade.
For a validator the takeaway is practical: security is not just having the patch. What matters is how fast the team can apply it, and whether it is ready to stop the chain before the damage becomes irreversible.
➡️Crouton.digital | About us⬅️