Cosmos EVM module: balance-sync bug hit TAC, MANTRA and KiiChain

What happened

• 20 to 25 Aug 2026: BlockSec estimates about USD 14.8M across the three disclosed chains. TAC lost about 2.986B TAC (about USD 7.5M) from its staking pool. MANTRA halted its chain on 20 Aug and said “no user funds were exploited”. Cosmos Labs advised Cosmos EVM chains to halt.
• Root cause per BlockSec: EVM balance sync subtracted delegated amounts from balance although delegations came from locked balances, so delegating 1 locked wei underflowed to MAX_UINT256. Fixes reportedly shipped in cosmos/evm v0.6.2 and v0.7.2 on 21 Aug. Some outlets instead tie MANTRA to the earlier ICS20 precompile advisory ASA-2026-002; that link is unconfirmed.
• Attribution: none.
• Response: chain halts and coordinated patches. TAC funds were bridged to BNB Chain.

Sources

• https://blocksec.com/blog/defi-security-incidents-cosmos-evm-moonwell
• https://www.techtimes.com/articles/325233/20260821/mantra-chain-hacked-via-cosmos-evm-bug-that-already-cost-saga-7m-january.htm
• https://www.xrplevm.org/blog/xrpl-evm-preventive-response-to-cosmos-evm-incident

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.