How a Cosmos EVM bug sat ignored for months — and cost nearly $6M
The bug, the exploit, and the money trail
In late August, a nasty accounting bug in Cosmos EVM deployments was weaponized against multiple networks, and the attackers walked away with just under $6 million across six chains. The exploit popped up on MANTRA first and then spread to others like TAC and KiiChain. Attackers moved tokens around — roughly $2.87 million through decentralized exchanges and about $2.85 million through centralized venues — and some of the exchange-linked accounts were later frozen.
The cheat code wasn’t new magic; it was classic integer math mischief. An underflow created an absurdly large balance in one place, which then let the attacker overflow another account and siphon off its real funds without inflating total supply. In MANTRA’s case, about 720.9 million tokens that were previously inert became transferable: roughly 600 million from a burn address and another 120.9 million from an old multisig. The team pegged that movement at around $3.6 million using pre-incident prices, and as of the initial report none of the funds had been recovered.
Why it lingered and how the response unraveled
The story gets messier when you look at the timeline. The bug was reported back on April 25, but engineers believed it only affected chains using six decimals. Production chains they knew about used 18 decimals, so the issue was considered low-risk for live funds. A fix was merged into the main code on May 15, handled quietly as a public patch rather than an emergency backport, because the change would break state and required coordinated upgrades.
That assessment flipped in early August when further checks showed the vulnerability could hit deployments regardless of decimal settings. Official patched releases were published late on August 19, and a public write-up describing the exploit surfaced the next morning. Less than 12 hours after that public disclosure, the first unauthorized MANTRA transaction took place.
Operational hiccups didn’t help. MANTRA’s monitoring system assumed the burn address could never move funds, so it didn’t flag the first unauthorized transaction for almost four hours. After a second suspicious debit arrived, the chain was halted just 14 minutes later, leaving it offline for about 30 hours. TAC reported exploitation about 45 hours after MANTRA, and KiiChain followed not long after.
The incident prompted a rush of coordination: teams reached out to roughly 40 networks, and 13 of them patched, halted, or otherwise mitigated the issue before they saw any losses. The response also revealed a bunch of Cosmos EVM deployments that hadn’t been on the radar before — 11 previously unknown deployments showed up in the aftermath.
Takeaways — awkward, but fixable
Lessons are obvious and a little embarrassing. First, triage assumptions can be dangerous: deciding a bug is harmless because of a presumed configuration turned out to be a costly gamble. Second, quiet patches that aren’t backported to older branches leave a big attack surface. And third, monitoring that makes hard assumptions (like a burn address being immobile) can miss the first signs of trouble.
Teams across the ecosystem have since pushed upgrades and revisited vulnerability disclosure and triage procedures. The incident is a reminder that protocol safety requires both solid code fixes and fast, conservative operational responses. In other words: don’t assume a dead address is sleeping — check the blankets.
