TAC Cosmos EVM Balance Underflow Drain

What happened

On 22 August 2026, TAC, a Cosmos-based EVM chain bridging the TON ecosystem, was drained of about $7.5m from a custodial account through a flaw in the shared Cosmos EVM module, and validators halted the chain at block 24,671,475. The same day KiiChain lost 148,326,583.15 KII to 18 repeats of the technique and halted at block 9,355,723, and MANTRA halted for roughly 30 hours before restarting.

The public advisory landed on 28 August as GHSA-7g4w-cg88-2cq2, rated critical: the EVM StateDB tracks only spendable balances and ignores locked vesting balances, so a vesting account delegating more than its spendable balance triggers an unchecked underflow that wraps the balance to about 2^256. The fix shipped in Cosmos EVM v0.6.2 and v0.7.2; no CVE has been assigned, and credit went to @AshmitSh4rma via the bug bounty alongside independent researchers. Cosmos Labs confirmed an active incident on 24 August and urged every chain on Cosmos EVM below the patched versions to halt validators; by 26 August it said many chains had patched, with a full incident report promised. BounceBit's 19 August exploit, logged separately here, came from the same Evmos and Cosmos EVM family. SlowMist logs TAC's loss at $7,500,000; reports of how many TAC tokens moved conflict, so no token figure is carried here.