Cosmos Labs under fire over disclosure of bug affecting four blockchains
Cosmos Labs has faced backlash from across the crypto security community over its disclosure of a bug in its Cosmos EVM module which has led to issues on four blockchains.
Four networks using the module, MANTRA, TAC, KiiChain and Nesa, all appear to be affected by the bug, which was quietly patched last week.
The module’s developer, Cosmos Labs, was eventually forced to issue a warning over the incidents, advising that validators of affected networks “halt their chains.”
Read more: YZi Labs-backed BounceBit Chain shuts down after $3M exploit
The original disclosure, branded “negligent AF,” matches Cosmos’ policy of a “silent patch model.”
However, it appears that dissemination efforts of the fix were insufficient to avert the incidents on the aforementioned networks.
Although the release notes state that “this release contains important security fixes. We recommend all chains upgrade to this patch release as soon as possible using a coordinated upgrade,” there was no warning on Cosmos Labs’ official X account.
Protos has reached out to Cosmos Labs for details on any private disclosures, but hadn’t received a response by time of publication.
Read more: Saga becomes latest victim in DeFi hacking spree
Four blockchains affected
In advance of Cosmos Labs’ warning, both MANTRA and Nesa had advised of chain halts, with seemingly no user funds affected.
Two further networks, TAC and KiiChain, weren’t so lucky.
On August 22, KiiChain wallets were drained of a total of almost 150 million KII. The tokens were worth over $9 million at the time — in theory — however, the proceeds were dumped for just $1.6 million of BUSD, briefly crashing the token’s price.
KiiChain called the loss “avoidable” in a post mortem report to X, openly blaming Cosmos Labs’ disclosure process.
“Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit,” it said.
The report also points to lack of advance notice, a failure to flag the update as critical and a delay in communicating the patch as contributing factors.
On the same day that KiiChain was exploited, Telegram-focused TAC network saw three billion TAC tokens, valued at around $7.5 million, drained from its staking contract.
In addition to this week’s chaos, another Cosmos EVM network, Saga EVM, lost approximately $7 million in January.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.