Nesa Exploit News: NES Token Drain Exposes Cosmos EVM Security Flaw

Nesa Exploit News: How the NES Attack Unfolded Across Cosmos EVM This Nesa Exploit news broke this week after on-chain investigators traced how a single wallet drained about $50M worth of the token using a sophisticated balance manipulation bug yet somehow walked away with only about $60K in real profit. Source: Bubblemaps' investigation thread on X The gap between the headline number and the actual payout has become the most talked-about part of this incident across crypto research circles. What Caused The Underlying Bug The root cause traces back to Cosmos Labs, which reported a security bug in its shared Cosmos EVM software — the underlying module used by multiple chains, including Nesa. Source: Cosmos Labs Cosmos Labs said an ongoing security incident had impacted users of the Cosmos EVM module and that its security and engineering teams were proactively responding to the situation. Because many chains are built on this same shared module, the vulnerability was not unique to one project alone. How The Main Exploiter Operated Investigators identified the main exploiting wallet labeled 0x9AE7 and traced its full playbook as part of this Nesa Exploit news timeline. Source: @bubblemaps on X The wallet first bought roughly $250K worth of NES and bridged it onto the Nesa chain. It then exploited the underlying bug to inflate its onchain balance by 200 times before bridging that inflated $50M sum back to Ethereum. Notably, this wallet was originally funded through Monero, with roughly $45K and $211K in separate transfers routed through privacy tools before reaching addresses connected to the exploit. Where The Stolen Funds Moved Next Once the tokens were bridged back, the attackerspread them across a wider network of wallets rather than cashing out from one address. Tokens were swapped for ETH across multiple decentralized exchanges before the resulting funds were deposited into centralized exchanges. Source: Bubble maps Several receiving addresses were identified in this fund distribution network, including 0x80c1f107E7929e2440c9E528466776ec7329e89 and 0x9b49E12a68185B9b5cC2EC469E9ef43719f51c7c, among others. Key steps in the fund movement include: About $250K in NES purchased and bridged onto the Nesa chain Balance inflated 200 times through the exploited bug About $50M worth of tokens bridged back to Ethereum Tokens routed through multiple wallets and swapped for ETH on DEXs Resulting ETH deposited across centralized exchanges Why The Profit Ended Up So Small Despite draining tens of millions in tokens, the attacker's actual profit came out to just $60K because liquidity was pulled from trading pools quickly once the exploit was detected, forcing later swaps into extreme slippage. Source: Bubble maps on X Onerecorded transaction on Etherscan shows this clearly—an aggregated swap attempting to sell 5,000,000 NES worth about $710K returned only about $1,928 worth of ETH, illustrating how thin liquidity had become by the time later swaps executed.