Cosmos EVM chains told to halt after security incident

Cosmos Labs urged affected Cosmos EVM chains to request validator halts on Aug. 25 as its security and engineering teams responded to an incident that had already reached multiple networks. Summary Cosmos Labs advised contacted Cosmos EVM chains to ask validators to halt during incident response. KiiChain reported 148,326,583.15 KII drained through 18 repeated attacks on August 22, 2026, officially confirmed. TAC said one account was drained before validators halted its network at block 24,671 Saturday. MANTRA resumed block production after roughly 30 hours and said user balances remained unchanged throughout. Cosmos Labs has not disclosed affected chains, vulnerability details or aggregate losses publicly to date. The company did not identify the underlying vulnerability, affected chains or total losses in its initial statement. It said users of the Cosmos EVM module had been affected and promised an incident report after the situation was resolved. Separate disclosures from MANTRA, TAC and KiiChain connect recent attacks to the Cosmos EVM software stack. However, Cosmos Labs has not publicly confirmed that these incidents share one exact vulnerability or named every chain asked to stop. You might also like: MANTRA Chain resumes blocks after Cosmos-EVM fix Cosmos EVM chains receive emergency halt advice Cosmos EVM is a shared software stack that lets Cosmos SDK chains execute Ethereum-compatible smart contracts. A vulnerability in a common module can therefore expose independent networks running affected versions or configurations. An ongoing security incident has impacted users of the Cosmos EVM module. Cosmos Labs’ security and engineering teams have been proactively responding to this incident. We have advised the Cosmos EVM chains that are in contact with us to request that validators halt their chains.… — Cosmos Labs (@cosmoslabs_io) August 24, 2026 Cosmos Labs said its teams were “proactively responding” and had contacted chains using the module. It asked those teams to coordinate with validators, which must collectively stop block production on decentralized proof-of-stake networks. A halt prevents new transactions from settling while developers investigate and distribute a fix. It also temporarily blocks regular transfers, applications and withdrawals that depend on the affected chain. Cosmos Labs directed other Cosmos EVM teams with questions to its security email. It did not publish a software version, mitigation instructions or a restart schedule, likely to avoid revealing exploitable details before chains are protected. KiiChain and TAC disclose token drains KiiChain said an attacker drained 148,326,583.15 KII from wallets on Aug. 22. Its incident report said the attacker repeated the technique 18 times before validators stopped the network at block 9,355,723. The team linked the attack to a Cosmos EVM vulnerability involving vesting accounts, staking operations and balance handling. KiiChain said the attacker bridged part of the assets to BNB Smart Chain through Hyperlane.