Cosmos Labs confirms Cosmos EVM security incident affecting three chains

Cosmos Labs confirmed an ongoing security incident affecting users of the Cosmos EVM module. Cosmos Labs advised chains in contact with it to ask validators to halt block production. KiiChain, TAC, and MANTRA disclosed incidents involving the module. MANTRA halted its chain as a precaution. The MANTRA team said two MANTRA-managed wallets were affected. The team said user balances were never impacted. MANTRA later resumed normal block production after the vulnerability was fixed in version 8.4.0. On August 22, an attacker used the same technique 18 times against KiiChain. The attacker drained 148,326,583.15 KII before validators halted the chain at block 9355723. KiiChain said the vulnerability is in the shared Cosmos EVM module rather than in KiiChain-specific code. KiiChain's chain remains halted. KiiChain plans to resume through a coordinated binary upgrade at a predetermined block height. All validators will apply the update simultaneously. The process will not require an on-chain governance proposal. TAC halted its chain at block 24,671,475 after an attacker drained a single account. TAC said the defect is in the shared module rather than in TAC-specific code. Cosmos Labs directed teams with questions to its security contact. Cosmos Labs said it will publish an incident report after the situation is resolved. Cosmos Labs has not described the cause.