A critical vulnerability within the Cosmos ecosystem resulted in over $6 million in losses across six networks after hackers exploited a flaw that had been known for months. The issue was initially reported in late April and silently patched in mid-May, but updated releases containing the fix were not published until August, leaving chains exposed to potential attacks.
Exploitation began on the MANTRA network shortly after the patched versions became available, forcing the platform to halt operations for 30 hours. A postmortem revealed that the attack did not involve minting new tokens but instead manipulated existing balances to make them transferable, highlighting the severe impact of the delayed public disclosure and release strategy.
Key facts
- Total financial losses exceeded $6 million across six directly exploited networks
- The vulnerability was reported on April 25, 2024, with a silent patch merged on May 15, 2024
- Publicly available patched releases (v0.6.2 and v0.7.2) were not issued until August 19, 2024
- Hackers began exploiting the MANTRA network on August 20, 2024, one day after the patch release
- MANTRA suspended its services for 30 hours to mitigate the ongoing attack
- The exploit allowed attackers to make existing balances transferable without minting new tokens
Why it matters
This incident underscores the risks associated with silent patches and delayed public releases in decentralized infrastructure, as the four-month gap between the initial fix and the public update provided a window for exploitation. It highlights the importance of coordinated disclosure and timely deployment of security updates to protect interconnected blockchain networks from cascading failures and financial theft.