Cosmos EVM Security Incident Forces 3 Chains to Halt as Validators Warned

Cosmos Labs has confirmed an ongoing security incident affecting the Cosmos EVM module, urging affected networks to ask their validators to halt block production while security teams investigate.

The incident has already impacted multiple Cosmos EVM chains, although the full scope of the vulnerability and potential losses remains undisclosed.

Cosmos EVM Chains Face Security Threat

Cosmos Labs said its security and engineering teams are actively responding to the incident and have advised Cosmos EVM chains in contact with the team to pause their networks.

The Cosmos EVM module allows Cosmos SDK-based blockchains to run Ethereum-compatible smart contracts. Because the same infrastructure is used across multiple networks, a vulnerability could potentially affect more than one chain.

Cosmos Labs has not yet disclosed the precise vulnerability or the total amount of funds potentially affected. The team said a detailed incident report will be released after the situation is resolved.

MANTRA, KiiChain and TAC Affected

The security incident has already been linked to three networks: MANTRA, KiiChain and TAC.

MANTRA was the first to halt its network after detecting suspicious activity. The project later identified the issue as being isolated to its Cosmos EVM module and deployed version 8.4.0. MANTRA subsequently resumed block production and said no user funds were affected.

KiiChain suffered a more severe incident. The network reported that an attacker exploited the vulnerability 18 times, draining 148.33 million KII before validators halted the chain. KiiChain said the issue sits within the shared Cosmos EVM code rather than its own proprietary code.

TAC also halted its network after an attacker drained a single account. The project similarly attributed the defect to the shared Cosmos EVM module rather than its own code.

The situation makes Cosmos EVM security a key concern for other networks using the module. Until Cosmos Labs completes its investigation and provides further technical details, affected chains may need to prioritize network halts and coordinated software upgrades over normal operations.