Cosmos Labs Faces Scrutiny After $5.7M Six-Chain Hack

What happened: An integer underflow bug in Cosmos EVM software enabled attackers to drain $5.7 million across six blockchains, including MANTRA, TAC, and KiiChain. The vulnerability, reported in April, was silently patched in May but only publicly released on August 19. Exploits began just 20 hours after the patch, with MANTRA alone losing $3.6 million. Cosmos Labs coordinated emergency responses with 40 chains and discovered 11 previously unregistered EVM deployments during the crisis.

Why it matters: The incident exposes governance and disclosure gaps in open-source blockchain security, as the four-month lag between bug report and public patch left multiple networks exposed. MANTRA’s leadership criticized the short window for deploying critical fixes, while the recurrence of a similar bug on Saga earlier in the year suggests systemic oversight issues. The episode may prompt calls for more transparent vulnerability management and faster, coordinated responses across multi-chain ecosystems.

Source: The Block, Cryptoslate, The Defiant