Cosmos Labs has urged affected networks in contact with its team to halt operations amid an ongoing security incident involving the EVM module.

Statements issued by KiiChain, TAC, and MANTRA have all pointed to flaws within the Cosmos EVM infrastructure when describing the attacks they faced in recent days. Cosmos Labs, however, has yet to establish publicly whether the incidents stemmed from one common flaw or clarify which networks were specifically instructed to suspend operations.

EVM Security Crisis Escalates

Cosmos Labs said it will publish an incident report once the situation has been resolved. Meanwhile, KiiChain said an attacker drained 148,326,583.15 KII from wallets on August 22, repeating the same technique 18 times against different targets. The chain detected the activity internally and halted at block 9,355,723, thereby stopping further theft and freezing funds that remained on the network. According to KiiChain, the root cause had been identified, reproduced and fixed.

It said that the vulnerability was in the shared Cosmos EVM module, rather than KiiChain-specific code. The chain said three upstream defects combined to enable the attack, including an underflow in the staking precompile when it writes a post-delegation balance back to the EVM, along with two other undisclosed bugs.

KiiChain said the same class of vulnerability affected Cosmos EVM chains with vesting accounts enabled and linked the issue to the compromises of MANTRA and TAC during the same week.

The handling of the vulnerability has also come under scrutiny. A security fix for one of the three flaws was made public on August 19, but KiiChain said affected networks were not given advance notice and the release was not clearly flagged as a critical security update. When communication reached the affected chains two days later, the fix was included with unrelated issues already being handled privately. It was not accompanied by a recommendation to halt networks.

By then, MANTRA had already been exploited. KiiChain said an emergency halt could have contained the risk much faster than a software upgrade, which requires validators to review, test, and deploy the patch.

TAC separately said an attacker exploited a vulnerability in the Cosmos EVM precompile layer on the same day and drained a single account. The chain was halted to stop the attack, and it was said that the defect was not in TAC-specific code. The chain said 2,985,651,403 TAC was moved between accounts. No new tokens were created, and the total supply remained unchanged. Only TAC was affected, while other assets on the network remained intact.

Mantra Security Incident

MANTRA halted its Layer 1 network last week as a precaution for about 30 hours. The project later said it had identified the root cause, contained the immediate threat, and that no user funds were exploited.

MANTRA said the incident affected two wallet addresses, and the network resumed operations after a patch was deployed.

Source: CryptoPotato