An attacker exploited a balance-calculation vulnerability affecting the shared Cosmos EVM module to inflate roughly $250,000 in Nesa’s NES token into about $50 million in nominal value before bridging the assets back to Ethereum. Severe slippage ultimately limited monetization of the attack to an estimated $315,000, leaving approximately $60,000 in net profit. The incident exposed both a shared-software security weakness and the gap between manufactured token value and executable market liquidity.
The vulnerability extended beyond Nesa because Cosmos EVM is a reusable framework that multiple Cosmos SDK chains integrate to support Ethereum-compatible applications. The official Cosmos EVM repository identifies networks including MANTRA and TAC among users of the framework. A weakness in a common execution component therefore created exposure across otherwise independent blockchain networks rather than remaining confined to one application or token.
NES Balance Was Artificially Expanded Roughly 200x
The Nesa attack began with approximately $250,000 of NES transferred onto Nesa Chain. The attacker exploited the balance flaw to increase the apparent position roughly 200-fold, then bridged about $50 million worth of NES to Ethereum and distributed the tokens across eight addresses. The exploit successfully created a large nominal balance, but it did not create matching liquidity capable of absorbing that supply.
As the attacker attempted to exchange NES through decentralized markets, available liquidity deteriorated and price impact increased. Roughly $255,000 was committed to the operation, while approximately $315,000 was ultimately converted, producing the estimated $60,000 profit. Liquidity depth became the effective ceiling on the attack, preventing tens of millions of dollars in artificial token value from being realized as actual proceeds.
The wider incident affected other Cosmos EVM users. KiiChain disclosed 18 exploit attempts involving 148,326,583.15 KII, while TAC and MANTRA also reported incidents associated with the shared module. Cosmos Labs subsequently urged affected operators to halt networks while mitigations were deployed. The simultaneous exposure demonstrates how dependency risk can propagate across sovereign chains when they rely on the same underlying software stack.
Shared Dependencies Turn Local Bugs Into Ecosystem Risk
That risk is well established outside blockchain infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency warns that vulnerabilities in widely used open-source components can create broader software-supply-chain exposure and recommends maintaining visibility into dependencies and rapidly deploying security updates. The Cosmos EVM episode provides a blockchain-specific example of that dependency problem, with one shared component affecting several separately operated networks.
Cosmos Labs recommended that chains using vulnerable Cosmos EVM releases halt and move to patched versions, including v0.6.2 or v0.7.2 where applicable. The project’s GitHub security policy also provides a coordinated vulnerability-disclosure process for weaknesses affecting supported releases. For validators and chain operators, remediation now depends on coordinated upgrades as well as reviewing historical activity for exploitation that occurred before the fixes were deployed.
The Nesa case also illustrates why exploit size and attacker profit should not be treated as interchangeable figures. Approximately $50 million in manipulated NES existed on paper, but market structure reduced the economically realizable outcome to a fraction of that amount. Further incident analysis will be needed to establish the complete cross-chain impact and whether additional affected balances or attack paths remain undiscovered.
