Unbelievable! Cosmos Publishes High-Risk Patch Without Prior Notice, Hackers 'Empty' Project Treasuries First
A series of preventable security attacks recently struck multiple Cosmos ecosystem blockchains—including MANTRA, TAC, KiiChain, and Nesa—all built using the Cosmos EVM module. Attackers drained protocol treasury wallets and dumped the stolen tokens, causing assets like KII, TAC, and NES to plunge over 90% within hours.
The root cause was a critical security vulnerability. On August 19, Cosmos Labs publicly released version v0.7.2 on GitHub, containing an urgent security patch. However, they failed to privately notify or coordinate with the dependent project teams beforehand, leaving the exploit details openly accessible. This allowed malicious actors to study and execute attacks before most teams could respond.
Affected projects like KiiChain criticized Cosmos Labs for bundling the critical fix with unrelated updates and not treating it with the necessary urgency, such as recommending chains to pause operations. The exploit combined three upstream flaws in the Cosmos EVM module, affecting any chain with vesting accounts enabled.
Despite some teams, like MANTRA, identifying the issue early, attacks continued for days. Nesa’s token crashed 94% before the team halted its chain. Cosmos Labs eventually issued a belated response, advising chains to pause, but widespread criticism highlighted a severe failure in vulnerability disclosure, patch coordination, and ecosystem communication.
This incident underscores deep flaws in Cosmos's security auditing, cross-chain coordination, and emergency response systems, further damaging confidence in an ecosystem already facing significant project departures and declining traction.
marsbit10 год тому
