KiiChain exploit analysis

On 22 August 2026, several Cosmos-based blockchains were exploited after Cosmos Labs publicly disclosed a vulnerability in the Cosmos EVM. The disclosure became its own story. KiiChain, one of the affected chains, wrote in its postmortem that "This loss was avoidable. ... Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit. Standard responsible disclosure exists precisely to prevent this. Cosmos Labs gave no advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains that a public release had happened until Friday 21 August, two days later." The exploit affected at least four chains, with widely different per-chain figures. KiiChain lost around 148 million KII, cashed out by the attacker for approximately $1.6 million. TAC, a Telegram-focused chain, was exploited for about 3 billion TAC (~$7.5 million). Nesa Chain was also hit; an attacker stole tokens nominally worth $50 million but limited liquidity meant the realised profit was around $60,000. A fourth chain, MANTRA, halted due to an exploit but reported that no user funds were affected.

The mechanism was a known vulnerability in the Cosmos EVM that became exploitable the moment it was publicly disclosed. By spending the same message on each fork's bridge or router, attackers could drain affected chains in parallel. The KiiChain postmortem's core complaint is not that the bug existed but that Cosmos Labs disclosed it without coordinating with the chains running the code. The disclosure happened on Wednesday 20 August. Cosmos Labs did not inform downstream chains that a public release had occurred until Friday 22 August, two days later, which is the inverse of standard coordinated disclosure practice.

The figures vary because chains at different interests. KiiChain's $1.6 million was the realised cash-out from 148 million KII. TAC's $7.5 million came from selling 3 billion TAC. Nesa's nominal $50 million loss was substantially smaller in dollar terms once the attacker could not liquidate most of the tokens. The total realised loss across all four chains is the sum of the realised amounts, not the nominal amounts, and the realised total is in the order of $9 million to $10 million.

The response was mixed. KiiChain published a detailed postmortem naming the disclosure process as the proximate cause and naming Cosmos Labs by name. Cosmos Labs has not issued a public statement changing its disclosure practices in the reviewed reporting.

Compared with the other 2026 disclosure-related incidents in the corpus, the Cosmos EVM case sits with the various cases where a vendor's project management released a patch without coordinated disclosure. The Term Finance exploit of 23 August used a different vector — governance capture — but is one of the other August lending-market incidents. The cluster of four Cosmos-based chains being exploited in the same 48-hour window after a public disclosure is not, in the corpus, a recurring pattern. It is the kind of event that disclosure standards exist to prevent.