The patch arrived before the warning

Three chains running the Cosmos EVM module were drained through the same defect. The path involves an underflow in the staking precompile when post-delegation balances are written back to the EVM, and affects chains with vesting accounts enabled. KiiChain reports two further upstream defects that remain undisclosed.

The losses

• KiiChain, 22 August: 148 million KII, about $9.7 million. 80.7 million KII was frozen at the halt; 64.6 million had already been sold on decentralised exchanges for roughly 1.61 million BUSD, and 3 million sent to KuCoin.
• TAC, 22 August: about 2.98 billion TAC, 62% of circulating supply.
• MANTRA, 20 August: no amount disclosed. MANTRA says only two of its own managed wallets were affected and that user and exchange funds were untouched.

This closes a question left open on 21 August, when MANTRA halted its chain citing an incident it declined to describe. It was this one. MANTRA resumed on 22 August on a patched v8.4.0.

The disclosure sequence

• 19 August, Cosmos Labs publishes the fix in the open, with no security advisory and no advance notice to downstream chains.
• 21 August, downstream chains are notified, two days later.
• 22 August, the recommendation to halt and upgrade goes out, by which point all three chains have been compromised.
• 24 August, KiiChain publishes its incident report.

KiiChain's objection is direct: publishing a security fix in the open, before the chains running that code have been told privately, hands the vulnerability to anyone reading the commit. A public patch is a disclosure whether or not it is labelled one, and the window it opens closes at the speed of the slowest operator, not the fastest attacker.

Where it stands

KiiChain and TAC remain halted with no restart date. The XRPL EVM sidechain is reported still running on the unpatched v0.6.1. Cosmos Labs' guidance is that anything below v0.6.2 or v0.7.2 should halt and upgrade.