KiiChain Halts Network After EVM Exploit Moves Funds Through Hyperlane to BSC

KiiChain has halted its blockchain after an EVM-module vulnerability allowed an attacker to move funds out of the network through Hyperlane and onto BNB Smart Chain. The team is tracing the assets with security and infrastructure partners while the network remains stopped. KiiChain has so far confirmed the cross-chain movement but has not published a verified loss amount, attacker address set or number of affected accounts. EVM Vulnerability Opened Route to BNB Smart Chain KiiChain operates an EVM-compatible Layer 1 built with the Cosmos SDK. Its EVM module is based on Cosmos EVM, allowing Ethereum-style transactions and smart contracts to run alongside the network’s Cosmos infrastructure. The initial disclosure places the vulnerability inside that EVM layer. Hyperlane was used as the cross-chain route for moving the funds to BSC, rather than being identified as the vulnerable component. KiiChain uses Hyperlane as part of its interoperability stack, connecting the network with external blockchains for asset transfers. The chain halt prevents further transactions while investigators trace the BSC-side fund movements and determine the full scope of the attack. The breach lands shortly after KII began public trading in mid-August, with the token designed to support transaction fees, network security and liquidity incentives across KiiChain’s onchain foreign-exchange infrastructure. KiiChain Had Already Patched Cosmos EVM Software in July KiiChain’s EVM stack had undergone security work shortly before the attack. A v7.3.0 upgrade shipped in July using a Cosmos Labs-coordinated Cosmos EVM hotfix that was initially distributed through a private patched dependency ahead of a July 27 public security disclosure. The coordinated upgrade was state-machine breaking and required validators to move to the patched EVM dependency at the same block height. Sunday’s incident disclosure identifies the EVM module as the source of the new vulnerability but does not yet identify the affected function or transaction sequence. A separate Hacken audit finalized in July reviewed KiiChain’s Layer 1 codebase, including its EVM-related architecture. The assessment recorded 36 findings across the reviewed scope, with 25 resolved, four mitigated and seven accepted. One finding was rated high severity and six were rated medium. The current attack will require a transaction-level post-mortem to determine which EVM path was abused and whether the exploited code was part of the previously reviewed or subsequently upgraded software. KiiChain Halt Follows MANTRA, BounceBit and Maya Exploits KiiChain is the latest network to stop block production during a concentrated run of chain-level security failures. A separate MANTRA Chain halt began on August 21 after an attacker exploited an upstream software dependency, forcing validators and MANTRA-managed infrastructure offline while developers prepared a patch. MANTRA’s response also included disabling cross-chain infrastructure and tracing fund movements.