KiiChain (Cosmos EVM precompile) hack — August 2026

KiiChain confirmed that 148,326,583.15 KII were drained from accounts on 22 August 2026, the same technique repeated eighteen times against different targets. The chain detected the activity itself and halted at block 9,355,723, which stopped further theft and left part of the proceeds frozen on the network. Its post-mortem puts the recoverable portion at 80.7m KII, or 54% of the total, because those tokens never left the chain.

The defect was not KiiChain's. It sits in the shared cosmos/evm module the chain runs unmodified, where an underflow in the staking precompile writing a post-delegation balance back to the EVM combined with two further upstream bugs. Cosmos Labs told the Cosmos EVM chains it was in contact with to have validators halt, but named no chains, published no software version and gave no mitigation steps; its promised post-mortem was still unpublished as of 26 August. TAC halted the same day and MANTRA had halted on 20 August, both citing the same shared module; MANTRA later restarted on version 8.4.0 reporting no user losses.

No party has published a dollar figure for the KiiChain drain. The amount recorded here is our own conversion of the officially confirmed token count at KII's price on the day of the incident, $0.0664 per CoinGecko, which puts the loss at roughly $9.85m. It is treated as a floor rather than a realisable sale value, since a drained token generally cannot be sold into its own market at spot. If KiiChain or Cosmos Labs publish a figure, this entry will be corrected against it.