ChainCatcher report: Cosmos Labs has issued a technical report acknowledging a prior misjudgment of an integer underflow vulnerability in Cosmos EVM, which led to attacks on six blockchain networks between August 20 and 25, resulting in the theft of approximately $5.7 million worth of tokens. Attackers exploited this vulnerability to underflow account balances to the maximum value of 2^256 - 1, then reversed the operation to withdraw the inflated balances, thereby stealing tokens from targeted accounts without minting new tokens. The report states that researchers submitted this defect via a bug bounty program on April 25, but testers were unable to reproduce it under existing Cosmos chain configurations, prompting Cosmos Labs to patch it silently in May. After independent researchers confirmed in early August that the vulnerability affected all Cosmos EVM chains, Cosmos Labs released a patch on August 19—but the first attack occurred approximately 20 hours later. Specific losses include: MANTRA lost 7.209 billion tokens (~$3.6 million), TAC lost nearly 3 billion TAC tokens, and KiiChain lost approximately 148 million KII tokens. Both MANTRA and KiiChain criticized Cosmos Labs for failing to notify affected chains in advance or recommend shutdowns; KiiChain noted that deploying the patch required several days, whereas a shutdown could have been accomplished in minutes. Cosmos Labs stated it has coordinated with 40 chains on the response and assisted 13 chains in completing patches or shutdowns prior to the attacks.
Cosmos Labs Admits Misjudged Vulnerability; Six Chains Attacked for $5.7M Loss
ChaincatcherShare
Summary
Vulnerability news broke this week as Cosmos Labs admitted it misjudged a flaw in the Cosmos EVM, resulting in attacks on six chains between August 20 and 25. The flaw enabled attackers to manipulate account balances, leading to a $5.7 million loss of tokens. A researcher reported the issue in April, but it was not clearly reproducible at the time. A patch was silently deployed in May, but early August on-chain updates confirmed it impacted all Cosmos EVM chains. A public patch was released on August 19, yet attacks began just 20 hours later. MANTRA, TAC, and KiiChain reported significant losses, criticizing Cosmos Labs for failing to alert chains or recommend immediate shutdowns. Cosmos stated it collaborated with 40 chains, assisting 13 in responding before the attacks occurred.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.