Cosmos EVM Chains Ordered to Halt as Shared Bug Drains Three Networks

Cosmos Labs recommended that public blockchains running its Cosmos EVM module below v0.6.2 or v0.7.2 halt and upgrade immediately to include security patches. The recommendation came six days after a fix was shipped without a security advisory, allowing an attacker to drain three chains: MANTRA, TAC, and KiiChain. KiiChain lost 148 million tokens worth $9.7 million, with two of the three underlying defects still unfixed upstream.

The vulnerability, known as The Vesting Account Trick, is in Cosmos code, not KiiChain code. An attacker computed an exploit contract address, converted it to a vesting account, then deployed the contract onto it. Any Cosmos EVM chain with vesting accounts enabled carries the same exposure, according to KiiChain's report.

KiiChain accuses Cosmos Labs of handling the disclosure in a way that created the window for the attack. The team says Cosmos Labs published a fix without advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains about the public release until two days later.