What happened
On August 24, 2026, an attacker used a balance-accounting bug in Cosmos EVM to take about 257.7M NES on the Nesa chain, nominally worth about $50M at the pre-crash price. The attacker bridged the tokens to Ethereum through Hyperlane and dumped them on CoW Protocol and Uniswap V4. Thin liquidity capped the payout: Bubblemaps estimated the attacker spent about $255K and took out about $315K, a profit near $60K.
Nesa said it had identified malicious behavior exploiting a Cosmos EVM vulnerability and paused services pending fixes. The same bug hit MANTRA, TAC, KiiChain and other Cosmos EVM chains that month. Cosmos Labs had received the report in April and merged a fix in May, but judged live chains unaffected and shipped the backported patch on August 19 without a specific advisory.
How it happened
- The attacker deployed a contract and turned it into a vesting account, then deposited about 1.11M
NESinto Nesa. - Through the staking precompile, the vesting account delegated coins that were still locked. The EVM
StateDBtracks only spendable balances, so delegating more than the spendable amount underflowed the account's EVM-visible balance to about 2^256. - In the same transaction the attacker moved part of that fake balance to victim accounts (reportedly including the zero address and a genesis-era multisig), overflowing their balances to zero and capturing the real
NESthey held. - The attacker withdrew about 257.7M
NESto Ethereum over the Hyperlane bridge, burned 25M, and sold about 185.7M on CoW Protocol and Uniswap V4.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
