What happened
On 22 August 2026 an attacker drained 148,326,583.15 KII from 18 wallets on KiiChain, using the same technique against each one. Rekt valued this at about $9.7 million at the pre-exploit price. KiiChain detected the drains internally and halted the chain at block 9,355,723 (22:50:58 UTC). According to KiiChain, the bug was not in its own code. It was in the shared Cosmos EVM module (cosmos/evm), which KiiChain runs unmodified. MANTRA and TAC were hit by the same class of attack that week.
The halt froze 80,728,575.06 KII (54.4%) in attacker addresses on KiiChain. KiiChain said it would move these to recovery wallets in the restart upgrade. The other 67,597,997.87 KII (45.6%) was bridged to BNB Smart Chain through Hyperlane. Of that, about 64.6M KII was sold on DEXs for roughly 1.61M BUSD, and 3M KII went to a KuCoin deposit address that KiiChain asked KuCoin to freeze. Rekt lists the attacker address as 0x0e7a96227fcf09f53d644ba6462d8c73993ef246, the same on KiiChain and BNB Chain.
KiiChain blamed Cosmos Labs for publishing a fix for one of the defects in a public repository on 19 August 2026 without warning downstream chains first. It said a chain-halt recommendation came only on 22 August, after MANTRA, TAC and KiiChain had been hit. For the restart, KiiChain planned the bug fixes, a block on new vesting accounts, a blocklist of the attacker addresses, and a 10M KII per 24 hours cap on its Hyperlane routes.
How it happened
- A normal wallet cannot delegate more than it can spend, so the attacker first worked out the address its exploit contract would be deployed to.
- It turned that address into a vesting account, then deployed the contract onto it, so the contract inherited vesting status.
- The contract delegated one wei more than its spendable balance (Rekt describes this as 2 KII plus one wei). An underflow in the staking precompile, when writing the post-delegation balance back to the EVM, set the contract's mirrored EVM balance to roughly 2^256.
- It then used two more upstream bugs, which were undisclosed at the time, to move real KII from a victim account onto itself. No new supply was created, and each drain was capped at the victim's actual balance.
- The attacker repeated this 18 times, bridged part of the proceeds to BNB Smart Chain through Hyperlane and sold it for BUSD, until the chain halt froze the rest.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
