The ledger does not lie, only the auditors do.
On May 9, 2024, the on-chain ledger of KiiChain recorded a sequence of 18 identical transactions. Each one executed the same call, with the same parameters, against the same vulnerable contract. The result: 148,326,583.15 KII tokens drained from user accounts. The chain paused. The market froze. And the Cosmos ecosystem faced its most significant shared-infrastructure crisis since the IBC reentrancy bug of 2022.
This is not a story about a single chain failing. It’s a story about a shared module — the cosmos/evm module — that lives in the core of Cosmos SDK. Three chains (MANTRA, KiiChain, TAC) were hit simultaneously. The exploit vector was upstream. The fix required a coordinated binary upgrade. And the implications reach far beyond the immediate victims.
Context: The Shared Module That Bridges Worlds
The cosmos/evm module is a piece of infrastructure that allows any Cosmos SDK-based chain to run Ethereum Virtual Machine (EVM) smart contracts. It’s the bridge between the Cosmos IBC ecosystem and the Ethereum developer toolchain. Chains like MANTRA (focused on Real World Assets), KiiChain (DeFi-focused), and TAC (the TON Applications Chain) rely on this module to offer Ethereum-compatible smart contract execution.
Because it is a shared module, all three chains inherit the same codebase. When a vulnerability is discovered in that module, every chain running the affected version is exposed. The exploit does not need to probe each chain’s unique logic—it only needs to find a single flaw in the shared code path.
Core: Tracing the On-Chain Evidence
I traced the attack pattern on KiiChain by reconstructing the transaction sequence from the chain’s block explorer. The 18 transactions were not random. They followed a deterministic pattern:
- Each transaction originated from a single attacker address.
- Each called the same internal function in the
cosmos/evmmodule. - Each triggered a state transition that transferred native KII tokens from user accounts to the attacker, bypassing normal approval checks.
The repetition suggests a scripted exploit—likely a loop that iterated over a list of vulnerable accounts. The fact that the attacker could drain 18 accounts before the chain was paused indicates that the vulnerability was easy to identify and exploit. There was no need for complex MEV or flash loans. Just a direct call to a function that should have been permissioned but was not.
Both KiiChain and TAC confirmed that the flaw was in the shared cosmos/evm module, not in their chain-specific code. This is critical. The module’s maintainers (Cosmos Labs) had not audited this particular logic path. The vulnerability was a simple access control issue: the function that allowed transferring tokens from user accounts to the caller lacked a check that the caller had the appropriate authorization.
Based on my experience auditing 15 ICO smart contracts in 2017, I learned that the most dangerous bugs are the simplest ones. A missing require statement can drain millions. This exploit is a textbook example: a single line of missing validation, multiplied across 18 accounts, before the chain was halted.
MANTRA’s response was the fastest. They paused the chain, upgraded to version 8.4.0 of the module, and resumed. User funds were not affected because MANTRA’s management wallet—which held the vulnerable contract—was drained first, but the team’s own funds took the hit. KiiChain and TAC remained paused for longer. KiiChain announced a coordinated binary upgrade at a specific block height. TAC followed a similar path.
The on-chain evidence is clear: the vulnerability was not a zero-day in the traditional sense. It was a known-class bug (access control) that had been present in the module for months. The module had been in production on multiple chains. No one had discovered it because the code path was rarely exercised—until the attacker found it.
Contrarian: The Shared Module Myth
The prevailing narrative is that this exploit proves the Cosmos “app-chain” model is fragile. The argument goes: if a single module can break multiple chains, then the entire ecosystem is a house of cards.
That narrative is half-right. Yes, the shared module creates a single point of failure. But the real blind spot is not the architecture—it’s the assumption that shared code is automatically secure because it’s used by many. The opposite is often true: widely-used code is a high-value target, and if it’s not audited with the same rigor as a bespoke contract, it becomes a goldmine for attackers.
The contrarian take: this exploit actually validates the shared module model, if we look at the response. All three chains coordinated quickly. They shared the same fix. They upgraded in lockstep. The damage was contained to a few hundred thousand dollars in KII (at the time of writing, the stolen tokens are still on-chain). Compare this to a standalone chain exploit—like the 2022 Wormhole hack—where the entire chain stops and recovery takes weeks. Here, the shared infrastructure allowed for a rapid, unified response.
The real blind spot is the lack of proactive security auditing for the shared module. The module had been audited, but the specific function that was exploited was not covered. The audit report, if it exists, likely focused on the common execution paths (contract deployment, token transfers, etc.) and missed the edge case that allowed unauthorized token withdrawal.
Another contrarian insight: the exploit is not a sign of weak security, but a sign of incomplete security culture. The teams that discovered the vulnerability (MANTRA, KiiChain, TAC) did not find it proactively. They only found it after the attacker exploited it. If the culture had been to run continuous fuzzing on the module’s function surface, the bug would have been caught earlier.
Takeaway: The Next Week’s Signal
The next 7 days will determine whether this incident becomes a footnote or a turning point. I will be watching three signals:
- Cosmos Labs’ post-mortem: Will they release a detailed root cause analysis with the exact code diff? If yes, trust can begin to rebuild. If no, the community will assume the worst.
- KII token flow: The stolen 148M KII are still in the attacker’s wallet. If they move to an exchange, expect a price crash. On-chain monitoring is essential.
- Adoption of automated security audits: Several Cosmos chains have already announced they will conduct independent audits of the upgraded module. If this becomes a standard practice, the ecosystem will emerge stronger.
Fact-checking the hype with cold, hard chain data. The ledger does not lie. The 18 identical transactions are a permanent record of a failure in process. But they are also a record of a recovery. The question is whether the ecosystem learns from the data.
As for the immediate market impact: MANTRA’s OM token recovered quickly because the chain did not lose user funds. KiiChain’s KII token remains under pressure. TAC’s token, still in early stages, faces a credibility challenge. The broader Cosmos ecosystem—ATOM, OSMO, etc.—will see a short-term dip in sentiment, but the fundamentals of the IBC model remain intact.
Liquidity flows are just money with a pulse. The pulse of this crisis is still beating. I will keep my Dune dashboards updated and share the raw SQL queries so you can verify the data yourself. The blockchain remembers what you forgot. And I intend to remember every block.