Attackers steal $50M in NES via Cosmos EVM vulnerability, profit only $60K

ChainCatcher reports that Bubblemaps posted on X that the attacker exploited a vulnerability in Cosmos EVM’s shared module to steal $50 million worth of NES tokens, but ultimately profited only around $60,000. Previously, Cosmos Labs had disclosed a security vulnerability in its shared Cosmos EVM software, affecting multiple chains built on this module, including Nesa. According to the disclosure, the primary attacker, whose address begins with 0x9AE7, previously spent $250,000 to purchase NES tokens and bridged them to Nesa Chain. The attacker then exploited the vulnerability to artificially inflate their account balance by 200 times and transferred $50 million worth of NES back to Ethereum. The initial funds for this wallet originated from Monero. The attacker subsequently distributed the tokens across multiple wallet addresses, exchanged NES for ETH on DEXs, and deposited the proceeds into centralized exchanges. Due to rapid withdrawal of liquidity from the pools, most of the attacker’s swap transactions suffered severe slippage. The attack cost approximately $255,000 and yielded only $315,000 in proceeds, resulting in a net profit of around $60,000. Bubblemaps noted that although another Cosmos EVM chain suffered a similar $1.4 million attack the day before, differences in fund sources and operational methods suggest the two incidents were likely carried out by different attackers. The report also mentioned that the NES token price once plummeted by 90%, but has since recovered significantly; the team attributes the rebound primarily to arbitrage activity driven by price discrepancies between DEXs and CEXs following the attack.