Cosmos EVM Security Incident Triggers Chain Halts; KiiChain Reports 148.3M KII Lost

Cosmos is dealing with an active security incident tied to its Ethereum Virtual Machine (EVM) module, prompting affected networks to move into containment mode as investigators work to identify the underlying flaw. Cosmos Labs urged validators running impacted EVM chains to halt operations to limit further risk while security teams assessed the vulnerability. The pause was aimed at preventing additional uncertain or potentially malicious transactions from propagating across networks connected to the affected module. Cosmos has not disclosed which chains were impacted, the size of any losses, or technical details of the vulnerability, keeping the immediate focus on containment. With validators coordinating network stoppages, attention has turned to root-cause analysis and determining what remediation is required before networks can safely resume. Disruptions across connected chains As the incident rippled through the ecosystem, three chains shared impact assessments and recovery steps. KiiChain reported the largest losses, saying attackers drained 148.3 million KII across 18 separate attacks before validators halted the network. In a postmortem report, KiiChain said more than half of the stolen tokens can be recovered because they did not leave the chain, amounting to 80.7 million KII, or 54% of the exploited tokens. KiiChain attributed the issue to Cosmos EVM code rather than its own, noting it used the Cosmos EVM module without modification. TAC said it contained exposure by halting at block number 24,671,475. Validators paused all operations after an attacker drained one account, stopping further exploitation. MANTRA said it avoided user losses by pausing operations for 30 hours and deploying Cosmos EVM version 8.4.0. After the deployment, the chain restarted, showing that patching can support a safe return to operations. KiiChain remains offline, and any restart will depend on coordinated validator updates. Root cause still not disclosed Even as some networks move toward recovery, the incident remains unresolved because the failure inside the shared Cosmos EVM module has not been publicly explained. MANTRA has resumed on Cosmos EVM version 8.4.0, while other networks remain halted as teams coordinate next steps. For now, damage estimates rely largely on chain-by-chain disclosures of unauthorized transactions involving the shared EVM module. These reports link activity to common EVM code but do not fully explain the technical breakdown. Until Cosmos Labs releases a formal incident report, chains may be able to patch known exposure but cannot confirm whether all related weaknesses have been addressed. Final Summary A security incident involving the Cosmos EVM module forced multiple chain halts. KiiChain reported losses of 148.3 million KII across 18 attacks. MANTRA resumed after deploying Cosmos EVM 8.4.0, but Cosmos has yet to disclose the root cause or the full scope of exposure.