{ "version": 1, "event_id": "evt_e76fdfcc6ef4904a", "url": "https://xiyu.news/events/evt_e76fdfcc6ef4904a/", "json": "https://xiyu.news/api/events/evt_e76fdfcc6ef4904a.json", "type": "security_incident", "status": "monitoring", "category": "crypto", "title": { "zh": "Cosmos EVM 共享模块漏洞与多链损失", "en": "Cosmos EVM shared-module flaw and multi-chain losses" }, "current_state": { "zh": "影响范围和责任已经进一步确认，修复情况仍需观察。", "en": "Scope and accountability are clearer; remediation remains under observation." }, "first_seen_at": "2026-08-22T08:00:00+08:00", "last_updated_at": "2026-08-29T08:00:00+08:00", "last_material_change_at": "2026-08-29T08:00:00+08:00", "confidence": 1.0, "updates_count": 3, "sources_count": 5, "entities": [ "bug", "chains", "cosmos", "cross-chain", "drains", "evm", "halt", "labs", "mantra", "networks", "reported", "shared", "six", "three", "urges", "vulnerability" ], "identifiers": [], "topics": [ "cosmos", "cross-chain", "evm", "mantra", "multi-chain", "network-halt", "security-exploit", "security-incident", "vulnerability" ], "updates": [ { "update_id": "upd_f93d0dfe3e47ef38", "event_id": "evt_e76fdfcc6ef4904a", "occurred_at": "2026-08-22T08:00:00+08:00", "published_at": "2026-08-22T08:00:00+08:00", "first_seen_at": "2026-08-22T08:00:00+08:00", "time_precision": "edition", "update_type": "initial", "material_change": true, "title_zh": "MANTRA 因 Cosmos EVM 模块事件暂停网络。", "title_en": "MANTRA halted its network over a Cosmos EVM module incident.", "what_changed_zh": "MANTRA 因 Cosmos EVM 模块事件暂停网络。", "what_changed_en": "MANTRA halted its network over a Cosmos EVM module incident.", "current_state_zh": "影响最初被视为单链事件。", "current_state_en": "The impact initially appeared limited to one chain.", "detailed_summary_zh": "2026年8月21日，MANTRA Chain在发现攻击者利用与其Cosmos EVM模块相关的上游依赖漏洞后，暂停了所有交易、转账和质押。修复版本v8.4.0正在DuKong测试网上测试，之后才能进行协调的主网重启。 此次事件对MANTRA用户和整个Cosmos生态系统影响重大，因为全网暂停使所有链上活动停止，并引发了对第三方依赖安全性的质疑。这一事件可能影响市场对基于Cosmos的EVM链及上游开源组件安全的信任。 MANTRA团队表示，暂停本身并未影响用户资金，但攻击者活动的完整资产影响尚未确认，资金流向正在追踪中。验证者被要求在官方宣布协调重启前保持主网节点离线，DuKong测试网的测试是补丁版本上线的门槛。", "detailed_summary_en": "On August 21, 2026, MANTRA Chain halted all transactions, transfers, and staking after an attacker exploited a vulnerability in an upstream dependency linked to its Cosmos EVM module. The patched release v8.4.0 is being tested on the DuKong testnet before a coordinated mainnet restart can occur. This is a high-impact security event for MANTRA users and the broader Cosmos ecosystem, as the network-wide freeze silences all onchain activity and raises questions about the security of third-party dependencies. The incident could affect trust in Cosmos-based EVM chains and in the safety of upstream open-source components. The MANTRA team says the halt itself did not affect user funds, but the full asset impact of the attacker's activity remains unconfirmed and fund movements are being traced. Validators are instructed to keep mainnet nodes offline until a coordinated restart is announced, with DuKong testnet testing serving as the gate for the patched release.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 1.0, "story_ids": [ "rss:www.theblock.co_rss.xml:22d9e7ab9bedff7e" ], "sources": [ { "url": "https://www.theblock.co/news/defi/2026-08-21-mantra-freezes-network-412416", "label": "The Block", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c551dd8ab5e1cb28", "event_id": "evt_e76fdfcc6ef4904a", "occurred_at": "2026-08-26T08:00:00+08:00", "published_at": "2026-08-26T08:00:00+08:00", "first_seen_at": "2026-08-26T08:00:00+08:00", "time_precision": "edition", "update_type": "escalation", "material_change": true, "title_zh": "Cosmos Labs 要求采用该 EVM 模块的链暂停运行，已确认至少三条网络受损。", "title_en": "Cosmos Labs urged affected EVM chains to halt after losses were confirmed across at least three networks.", "what_changed_zh": "Cosmos Labs 要求采用该 EVM 模块的链暂停运行，已确认至少三条网络受损。", "what_changed_en": "Cosmos Labs urged affected EVM chains to halt after losses were confirmed across at least three networks.", "current_state_zh": "事件扩大为共享组件导致的多链安全事故。", "current_state_en": "The incident expanded into a multi-chain shared-component failure.", "detailed_summary_zh": "Cosmos Labs 呼吁基于其共享堆栈构建的 EVM 链暂停运营，因为一个漏洞导致三条网络被盗。受影响链之一 KiiChain 报告损失了 1.48 亿枚代币，而暂停建议是在补丁发布六天后才发出，且当时未发布公开安全公告。\n\nCosmos EVM 堆栈的共享漏洞意味着许多链可能同时暴露在风险中，而不仅仅是单个网络。此类事件可能削弱用户对生态系统的信任，并凸显跨链协调安全披露的迫切必要性。\n\nKiiChain 表示，三个底层缺陷中有两个在上游仍未修复。补丁发布与公开安全公告之间的延迟，可能让其他链未能及时意识到这一严重风险。", "detailed_summary_en": "Cosmos Labs recommended that EVM chains built on its shared stack halt operations after a vulnerability drained three networks. KiiChain, one of the affected chains, reported losing 148 million tokens, and the halt advisory came six days after a patch shipped without a public security advisory.\n\nA shared vulnerability in the Cosmos EVM stack means many chains may be exposed at once, not just a single network. This incident can undermine trust in the ecosystem and highlights the critical need for coordinated security disclosure across interconnected chains.\n\nKiiChain stated that two of the three underlying defects remain unfixed upstream. The delay between the patch release and the public advisory may have left other chains unaware of the critical risk.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.0, "references": [], "confidence": 1.0, "story_ids": [ "rss:thedefiant.io_api_feed:dd7c7061b5975449" ], "sources": [ { "url": "https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_59ea7921f4ecd054", "event_id": "evt_e76fdfcc6ef4904a", "occurred_at": "2026-08-29T08:00:00+08:00", "published_at": "2026-08-29T08:00:00+08:00", "first_seen_at": "2026-08-29T08:00:00+08:00", "time_precision": "edition", "update_type": "aftermath", "material_change": true, "title_zh": "后续调查称漏洞曾被低估数月，影响扩大到六条链，Cosmos Labs 承认判断失误。", "title_en": "Later reporting said the flaw was underestimated for months, affected six chains, and prompted Cosmos Labs to acknowledge its error.", "what_changed_zh": "后续调查称漏洞曾被低估数月，影响扩大到六条链，Cosmos Labs 承认判断失误。", "what_changed_en": "Later reporting said the flaw was underestimated for months, affected six chains, and prompted Cosmos Labs to acknowledge its error.", "current_state_zh": "影响范围和责任已经进一步确认，修复情况仍需观察。", "current_state_en": "Scope and accountability are clearer; remediation remains under observation.", "detailed_summary_zh": "8 月 28 日，Cosmos Labs 披露一个被误判的 EVM 漏洞在包括 MANTRA、TAC 和 KiiChain 在内的六个网络上被利用，造成近 600 万美元损失。该漏洞于 4 月 25 日首次上报，但因小数位假设被评估为低风险；5 月 15 日合并了静默补丁，而在评估修正后，实际攻击始于 8 月 20 日。\n\n该事件暴露出共享软件层 Cosmos EVM 在数月内的安全分级失误，而这一层为 Cosmos SDK 链提供以太坊兼容性。由于约 40 条网络可能受影响，并在响应过程中发现 11 个此前未知的部署，这引发了关于整个 Cosmos 生态中安全披露和补丁分发的紧迫问题。\n\n该漏洞利用结合了两个记账缺陷：无符号整数下溢生成了异常巨大的余额，随后利用该状态使另一个账户溢出，从而在不增加总代币供应量的情况下提取其合法余额。Cosmos Labs 联系了 40 条网络，其中 13 条潜在暴露的链进行了修补、暂停或部署缓解措施；MANTRA 遭受了已披露的最大损失，约有 7.209 亿枚代币从两个未授权地址被转出。", "detailed_summary_en": "On August 28, Cosmos Labs disclosed that a misjudged EVM vulnerability was exploited across six networks, including MANTRA, TAC, and KiiChain, causing nearly $6 million in losses. The flaw was first reported on April 25 but was deemed low-risk due to decimal assumptions; a silent patch was merged on May 15, and the real exploit began on August 20 after the assessment was revised.\n\nThis incident exposes a months-long triage failure in a shared software layer — Cosmos EVM — that provides Ethereum compatibility to Cosmos SDK chains. With roughly 40 networks potentially affected and 11 previously unknown deployments discovered, it raises urgent questions about security disclosure and patch distribution across the broader Cosmos ecosystem.\n\nThe exploit combined two accounting failures: an unsigned-integer underflow created an abnormally large balance, which was then used to overflow another account and extract its legitimate balance without increasing total token supply. Cosmos Labs contacted 40 networks, with 13 potentially exposed chains patching, halting, or applying mitigations; MANTRA suffered the largest disclosed hit, with about 720.9 million tokens moved from two unauthorized addresses.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 1.0, "story_ids": [ "rss:cryptoslate.com_feed_:21be4de7336ce345", "rss:www.theblock.co_rss.xml:fe77904255f03fe3", "google_news:article:67f52d46815b6359" ], "sources": [ { "url": "https://cryptoslate.com/cosmos-misjudged-a-critical-bug-for-4-months-before-hackers-stole-nearly-6-million-across-6-chains/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMicEFVX3lxTE5TS094NGgzR2NuUUZndHp6RFpxX1RvSEpJTUQwaURhZ0c4bTVIeF9MSkhVdEFkR1h1eGtRRWppRXpJaTF3STN4cEdPWElNLTFLN1dMbEdMNW00STR5aWVvck95UXNlenNIT2lVRm1aU3M?oc=5", "label": "CryptoTicker", "source_type": "google_news", "official": false } ] } ] }