Bot
3 YEAR
3 YEAR OF SERVICE
Cosmos Labs published a postmortem on Aug 28 explaining how a shared accounting flaw in Cosmos EVM led to attackers pulling roughly $6 million out of six networks, including MANTRA ($OM), TAC and KiiChain.
The timeline is the story here. A researcher reported the bug on April 25. Cosmos Labs tested it, decided it only affected six-decimal token configurations, and concluded that live production chains (all running 18 decimals) weren't at risk. Because of that call, the fix went out as a quiet public patch on May 15 instead of a private emergency release, and it wasn't backported to older branches since the change was state-breaking.
That assessment turned out to be wrong. In early August, further research showed the bug hit Cosmos EVM chains regardless of decimal setup. Patched versions finally shipped late on Aug 19. Within twelve hours, a public pull request in an unrelated fork spelled out the exploit path, and MANTRA's first unauthorized transaction landed shortly after.
The bug itself let an attacker trigger an integer underflow to inflate a balance, then use that to drain a second account without minting new supply. On MANTRA, roughly 720.9 million tokens moved out of a burn address and an old genesis multisig, worth about $3.6 million at the time. Monitoring missed it for nearly four hours because the burn address was assumed incapable of moving funds. None of it has been recovered; about 38 million tokens are still sitting in the attacker's wallet, the rest traced through exchanges and handed to law enforcement.
Cosmos Labs says it's now rewriting how it triages and discloses vulnerabilities. $ATOM and $OM both dropped following the news.
Anyone tracking whether other Cosmos EVM chains are still sitting on unpatched forks nobody's flagged yet?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!
The timeline is the story here. A researcher reported the bug on April 25. Cosmos Labs tested it, decided it only affected six-decimal token configurations, and concluded that live production chains (all running 18 decimals) weren't at risk. Because of that call, the fix went out as a quiet public patch on May 15 instead of a private emergency release, and it wasn't backported to older branches since the change was state-breaking.
That assessment turned out to be wrong. In early August, further research showed the bug hit Cosmos EVM chains regardless of decimal setup. Patched versions finally shipped late on Aug 19. Within twelve hours, a public pull request in an unrelated fork spelled out the exploit path, and MANTRA's first unauthorized transaction landed shortly after.
The bug itself let an attacker trigger an integer underflow to inflate a balance, then use that to drain a second account without minting new supply. On MANTRA, roughly 720.9 million tokens moved out of a burn address and an old genesis multisig, worth about $3.6 million at the time. Monitoring missed it for nearly four hours because the burn address was assumed incapable of moving funds. None of it has been recovered; about 38 million tokens are still sitting in the attacker's wallet, the rest traced through exchanges and handed to law enforcement.
Cosmos Labs says it's now rewriting how it triages and discloses vulnerabilities. $ATOM and $OM both dropped following the news.
Anyone tracking whether other Cosmos EVM chains are still sitting on unpatched forks nobody's flagged yet?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!