Cosmos Labs has called on networks using its EVM module to ask their validators to halt their chains while engineers respond to vulnerabilities in the software that brings Ethereum-compatible execution to Cosmos SDK networks.

The emergency halt request, issued on X, came after several Cosmos EVM networks took defensive action and KiiChain suffered the largest confirmed loss. Because the module is shared code, the request effectively treated every network running it as potentially exposed until patched, underscoring how a single upstream defect can ripple across many chains rather than stay confined to one application. Cosmos Labs said it is coordinating with affected teams and plans to publish a full incident report once the remaining security work is completed.

KiiChain Attack Moved 148 Million KII

KiiChain's August 22 exploit moved 148.33 million KII through 18 attack rounds before validators stopped the network at block 9,355,723. According to the project's incident analysis, the attack abused vulnerabilities in shared Cosmos EVM components rather than KiiChain-specific application code, expanding the security issue beyond a single network.

More than half of the stolen tokens remain recoverable. About 80.73 million KII, or 54.4% of the stolen amount, never left KiiChain and remain frozen at attacker-controlled addresses. Another 67.6 million KII crossed through Hyperlane to BNB Smart Chain, where 64.6 million were sold for BUSD and USDT and 3 million reached KuCoin. A freeze request has been submitted for the exchange deposit. Tracing bridge transfers and flagging deposits at centralized venues are standard steps in crypto incident response, since exchanges can block flagged funds offchain.

The earlier KiiChain halt initially left the loss amount unresolved while the team traced the BSC transfers. Hyperlane served as the route out of KiiChain after the EVM exploit and has not been identified as the vulnerable component.

KII has recovered sharply from the selloff that accompanied the attack. The token was trading near $0.061 early Tuesday after reaching an all-time low of $0.01131 on August 22, a rebound of more than 400%.

Warden Ships Patch as MANTRA Also Halts

Warden Protocol released version 1.0.2 on August 23, upgrading Cosmos EVM to v0.6.2 and blocking the creation of vesting accounts through the affected path. The release followed Cosmos EVM v0.6.2 and v0.7.2, both published August 19 with security fixes requiring coordinated, state-breaking upgrades. On Cosmos SDK chains, such upgrades require validators to switch to new software at an agreed block height, which is why emergency halts are an established containment measure in this ecosystem.

MANTRA had already halted its mainnet on August 21 after isolating an exploit to an upstream software dependency. Validators, public endpoints, and MANTRA-operated cross-chain infrastructure were stopped while patched software was prepared.

Cosmos EVM embeds a full Ethereum Virtual Machine inside Cosmos SDK chains, allowing Solidity contracts to interact directly with native staking, governance, and IBC modules through precompiles. Precompiles sit at the boundary between the two execution models, which makes them a security-sensitive surface in EVM-compatible chains. KiiChain's incident analysis identified three defects involved in the exploit path, while only the underflow component had been publicly patched upstream when the report was released.

KiiChain remains halted while its patched upgrade is prepared. The restart plan includes recovering the 80.73 million KII still held onchain and adding withdrawal limits to cross-chain routes before normal operations resume. Still outstanding are Cosmos Labs' full incident report and the coordinated upgrades on other networks running the module.