By now you’ve probably heard that yet another attacker has hacked the largest zkLend protocol, withdrawing 3,300 ETH worth $5 million. Starknet’s decentralised lending protocol zkLend was hacked for $...

Cosmos EVM Flaw Exploited After Widespread Blockchain Exposure Was Confirmed It has been revealed that Cosmos Labs has disclosed exploiting a critical vulnerability in its shared Cosmos EVM module, which resulted in the exploitation of funds from six blockchain networks between August 20 and August 25, 2026. GHSA-7g4w-cg88-2cq2 affects Cosmos EVM versions below 0.6.2 and versions between 0.7.0 and 0.7.1  Cosmos Labs has classified the issue as Critical, however the advisory is not accompanied by a CVE, weakness classification, or CVSS score. In the versions 0.6.2 and 0.7.2 patches, state-breaking changes were introduced, so affected chains were required to perform coordinated network upgrades. Cosmos Labs has advised operators that if they cannot complete an immediate upgrade, they should cease operations, rather than proceed with governance-based upgrades while remaining exposed.  A vulnerability was reported by the company on April 25 through a bug bounty program. Following a failure by Cosmos Labs to reproduce the issue on networks using 18-decimal configurations, the team initially concluded that the issue did not pose a threat to funds on live networks. It turned out that assessment was incorrect as the team established on August 13 that the vulnerability affected Cosmos EVM chains regardless of their decimal configurations.  After the flaw was discovered, Cosmos Labs developed a public silent-patch process, which was designed to address vulnerability that does not present a risk of fund loss on production networks. The patch was released on August 19, one day prior to the first reported exploit. It has since been revealed that several affected blockchains have halt their chains following successful attacks on their funds. KiiChain and TAC have halted their chains as a result, while MANTRA has temporarily closed its mainnet and later restarted it after the fix has been applied.  Three Networks Confirm Cosmos EVM Exploitation A security incident was reported by MANTRA among the first networks. The team initially described the incident as a result of an upstream dependency, which led to a halt of the chain. The team said user balances were not impacted, while two wallets controlled by MANTRA were compromised. The vulnerable component was identified by MANTRA as the Cosmos EVM module and reported that version 8.4.0 had been released to address the issue, resulting in the normal block production process returning.  In August, KiiChain confirmed a direct exploitation of the vulnerability. The attacker reportedly utilized the same technique 18 times, draining 148,326,583.15 KII before the network was halted at block 9,355,723 by validators. According to KiiChain, the vulnerability can only be found in the Cosmos EVM module rather than in its own chain-specific implementation of the Cosmos EVM module. This network has been suspended and is expected to resume via coordinated binary upgrades at a predetermined block height, with validators applying the new versions simultaneously.  TAC also suspended its network at block 24,671,475 on August 22 after an attacker drained funds from a single account. The team attributed the vulnerability to the Cosmos EVM module instead of TAC-specific code. Cosmos Labs has informed affected teams that they should contact their security contact, and a more comprehensive incident report will be released once the situation has been resolved. The company has not disclosed what caused the vulnerability.  Flaw Allowed Balance Manipulation Across Affected Chains This vulnerability is associated with the way Cosmos EVM reconciles Ethereum-style account balances with Cosmos SDK's x/bank module. The EVM tracks the balance of an account, and vesting accounts may also contain funds that remain locked. Staking functions are still capable of delegating locked funds.  An underflow of balance could occur if a vesting account delegated more than its available spendable balance. In lieu of rejecting the transaction, the calculation wrapped the balance into an extremely large UINT256 value. Cosmos EVM was then able to interpret the altered balance as newly created funds during reconciliation. The same mechanism could also be used against another account. Attackers could transfer artificially inflated amounts to victims' accounts, resulting in the subsequent reconciliation process burning their legitimate balances.  By creating vesting accounts without permission, the attack was successful. Using a contract deployed at a predetermined address, the attack was completed in a single transaction. This was a result of an underflow check introduced in May that was then backported to the release branches affected by the issue. The handling of locked balances has also been corrected, and a separate safeguard has restricted modifications to module accounts involving balance modifications.  Patch Distribution Drew Scrutiny Along with the technical issue, Cosmos Labs' handling of the vulnerability has become a major concern. Cosmos Labs confirmed on August 13 that the issue affected Cosmos EVM networks regardless of their decimal configuration, however, a silent patch process was used to apply the patch.  Shortly after the patched releases became available on August 19, a public pull request was made in Push Chain's Cosmos EVM fork, describing the vulnerability and its exploitation method. A less than 12-hour period later Cosmos Labs reported the first reported attack on MANTRA. It is believed that six networks have been exposed to the exploit. On the basis of information provided by the affected chains, approximately $2.87 million worth of assets were traded through decentralized exchanges, while another $2.85 million was traded through centralized exchanges. The figures have not been independently audited.  Cosmos Labs reports that 11 Cosmos EVM deployments that had not registered security contacts were discovered during the incident. The incident has also highlighted difficulties in reaching downstream operators. Due to the fact that there are over 115 public blockchains in the Cosmos ecosystem and no database of the networks that run its software, distributing urgent security updates remains a complex effort.

  NFT projects lost an estimated $1 million in cryptocurrency last week after attackers infiltrated their core minting infrastructure by posing as IT personnel. The breach affected the fan-token marketplace Favrr along with Web3 ventures Replicandy and ChainSaw, among others. Onchain investigator and cybersecurity analyst ZackXBT reported that the perpetrators rapidly issued massive waves of NFTs, crashing floor prices to zero. They then liquidated their holdings before project teams could mount a response. According to findings, the attackers quietly embedded themselves within development teams by using fake identities. With insider access to minting contracts secured, they unleashed thousands of tokens and NFTs in a matter of minutes. The sudden influx of minted assets tanked floor prices and allowed the thieves to convert assets into liquid funds almost immediately. Within just a week, approximately $1 million disappeared from the affected treasuries. Favrr endured some of the heaviest losses as the attackers dumped tokens faster than the market could absorb them. Replicandy and ChainSaw were hit with similar tactics—Replicandy’s floor prices collapsed nearly instantaneously. ChainSaw’s stolen crypto remains dormant in wallets, awaiting laundering operations to funnel the funds back through exchanges. ZackXBT noted, “Nested services then further obscured the money trail.” Investigators revealed that onchain transactions moved the stolen assets through multiple wallets and exchanges, making the flow challenging to trace. Analysts warn that following mixed outputs could take weeks as exchanges comb through extensive transaction logs. This process slows or even prevents law enforcement from freezing compromised accounts. In a related incident from May 2025, the Coinbase data breach exposed personal information of roughly 69,461 customers after contractors were bribed to hand over user details, sparking an extortion attempt against the platform. The NFT and Web3 infiltration closely resembles the tactics of Ruby Sleet, a group that in November 2024 targeted aerospace and defense companies before pivoting to IT firms via fraudulent recruitment campaigns. Their strategy combined social engineering, credential theft, and malware to compromise systems. Experts say these blockchain and NFT breaches highlight how open, irreversible ledgers amplify operational errors—especially when insiders gain privileged access. As ZackXBT underscored, “When insiders gain privileges, there’s often no undo button.” Security professionals are advising NFT and Web3 organizations to adopt stricter zero-trust models that restrict each developer’s permissions. Requiring multi-party approvals before any large-scale minting can help prevent sudden attacks. Additionally, deploying real-time monitoring tools can quickly detect suspicious activity, while thorough code reviews and identity verification for every hire are critical to closing vulnerabilities before they can be exploited.