The organization's post-mortem acknowledges that engineers incorrectly concluded the flaw only affected chains using six decimal places for token accounting. Because all known production Cosmos EVM networks used the standard 18 decimal places, the practical assessment was that zero production chains were at risk, a judgment that held for nearly three months.

When that conclusion was reversed, the resulting patch was published to a public code repository without advance private warning to the downstream networks running the software. Attackers appear to have read the fix, reverse-engineered the vulnerability, and moved before most chains could act.

---

What Went Wrong

The flaw, catalogued as GHSA-7g4w-cg88-2cq2 and rated critical, sits inside the cosmos/evm module. That component is what allows Cosmos SDK chains (which use the Cosmos framework for building sovereign blockchains) to run Ethereum-compatible smart contracts. Specifically, an unchecked subtraction in delegated balance calculations causes an integer underflow: the balance wraps around to approximately 2^256, the maximum value for a 256-bit unsigned integer, effectively giving an attacker unlimited funds to drain.

A bug bounty submission flagged the issue on April 25, 2026. Engineers tested the flaw and found they could not reproduce it on networks using 18 decimal places for token accounting, which is the Ethereum standard and the configuration used by all known production Cosmos EVM networks at the time. Based on that finding, the team downgraded the risk level and addressed it through routine patching rather than emergency disclosure procedures.

Two fixes were merged quietly into the public codebase on May 15 and May 20, with no coordinated disclosure to affected chains.

Internal research overturned that conclusion in early August. On August 13, Cosmos Labs internally confirmed that all Cosmos EVM deployments were potentially at risk regardless of decimal configuration. Emergency patch versions v0.6.2 and v0.7.2 were published to GitHub on August 19. No private notifications went out to affected networks before the commit became publicly visible.

A public pull request that exposed the vulnerability's specifics went live on August 20. The patch had been public for only approximately 20 hours before the MANTRA attack began. MANTRA stated that it could not identify what flaw the fix addressed from the public release notes, meaning the patch was available but its purpose was opaque to the teams that needed to act on it. MANTRA was attacked within roughly 12 hours of the pull request going live.

The disclosure failure was compounded by a striking inconsistency in the record. Cosmos Labs had formally listed MANTRA in March 2026 as having already remediated a related vulnerability in the same module. Despite that designation, MANTRA was successfully exploited five months later through overlapping attack surface in the same codebase. The post-mortem identifies this discrepancy as central to its findings.

The first private notification to any downstream chain arrived at 03:36 UTC on August 21, after MANTRA had already reported a compromise.

In its post-mortem, Cosmos Labs stated: "We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks. Based on that assessment, [we] addressed the vulnerability through its silent, public patch process rather than the private patch distribution process."

---

Chain-by-Chain Losses

MANTRA absorbed the largest confirmed loss. Roughly 720.9 million OM tokens were moved from a burn address and legacy multisig, representing approximately $3.6 million at pre-incident prices of around $0.005060 per token. The OM token dropped about 18% to an all-time low of $0.004126 before the chain halted. Trading volume surged roughly 600% during the chaos.

KiiChain lost 148.33 million KII tokens across 18 separate attack rounds. Approximately 64.6 million of those tokens were sold on-chain for BUSD and USDT, realizing about $1.6 million for the attacker. KII hit an all-time low of $0.01131 before the chain halted and subsequently rebounded around 400%.

TAC had 3 billion tokens taken from a staking contract with a face value near $7.5 million. The token fell more than 90% within hours. That nominal figure diverges substantially from the realized loss: TAC's contribution to the $5.72 million aggregate total reflects post-collapse values rather than the face-value amount, which accounts for why the chain figures do not sum directly to the headline total.

Nesa saw the attacker mint and bridge roughly $50 million in nominal NES token value, but collapsing liquidity left realized gains at approximately $60,000, with the NES price falling from $0.22 to $0.011, a decline of approximately 94%.

Two additional chains were exploited but have not been publicly named. Not every notified network was compromised: Warden Protocol, ZetaChain, and Push Chain each implemented fixes without incident. Cosmos Labs says it contacted 40 networks during incident response; 13 patched or halted in time. The process also uncovered 11 previously unknown Cosmos EVM deployments. Of funds moved, roughly $2.87 million went through decentralized exchanges and $2.85 million through centralized exchanges, with some accounts subsequently frozen.

---

Regional Stakes

MANTRA is not a generic layer-1 chain. It holds an active Virtual Assets Regulatory Authority license in Dubai, is party to a $1 billion tokenization deal with UAE conglomerate DAMAC Group, and has institutional partnerships with firms including Libre, MAG, Novus Aviation, and Zand Bank across the Gulf and South Asia. In 2024, MANTRA raised $11 million specifically to accelerate real-world asset adoption in those regions.

The chain was built specifically for real-world asset tokenization, the process of putting ownership rights to physical assets onto a blockchain, in MENA and South Asia.

The attack unfolded during Dubai RWA Week 2026, a high-profile industry event positioning the UAE as the global hub for institutional tokenization, compounding the reputational damage at a moment of maximum visibility for the sector. A network halt lasting roughly 30 hours and a token at record lows creates concrete counterparty-risk questions for institutional partners in those regions.

KiiChain is built as a foreign exchange settlement platform targeting Latin America and Africa, with stablecoin support for Colombian pesos, Argentine pesos, Mexican pesos, and Brazilian reais. Its stated mission is 24/7 cross-border settlement for communities underserved by traditional banking. An emergency halt directly interrupts that mission.

---

Pattern and Precedent

This is not the first incident in this module family. The Saga EVM network lost approximately $7 million through a related Cosmos EVM bug in January 2026, and MANTRA was reportedly among the chains Cosmos Labs contacted during that remediation. Cosmos Labs formally marked MANTRA as remediated by March 2026. That claim sits in direct tension with the successful exploit five months later, and the pattern points to systemic weaknesses in how remediation is verified and how downstream chains are engaged across the entire coordinated disclosure lifecycle.

KiiChain said directly that publishing a security fix in the open before downstream teams have been privately notified "hands the vulnerability to anyone reading the commit." KiiChain also publicly accused Cosmos Labs of "irresponsible behavior" and stated that the incident "could have been avoided" with proper notification and coordinated deployment guidance. Developer @justde wrote publicly: "If attackers can read GitHub, downstream teams need something better."

The incident lands as ATOM has declined more than 95% from its peak and several prominent Cosmos projects including Neutron, Mars Protocol, Secret Network, Noble, and Pryzm have ceased operations or migrated away in the past six months.

How the organization responds to calls for a private notification framework will likely shape whether remaining Cosmos SDK developers treat the platform as viable infrastructure for production deployments.