KiiChain (Cosmos EVM precompile) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Blockchain or validator set |
| Loss | $3,674,000Price at time of incident |
| Recovered | $1,999,000 |
| Method | Contract logic errorAn underflow in the shared Cosmos EVM staking precompile writing a post-delegation balance back to the EVM, repeated eighteen times against different targets |
| Chains | Other |
| Outcome | Partially recovered |
What happened
KiiChain confirmed that 148,326,583.15 KII were drained from accounts on 22 August 2026, the same technique repeated eighteen times against different targets. The chain detected the activity itself and halted at block 9,355,723, which stopped further theft and left part of the proceeds frozen on the network. Its post-mortem puts the recoverable portion at 80.7m KII, or 54% of the total, because those tokens never left the chain.
The defect was not KiiChain's. It sits in the shared cosmos/evm module the chain runs unmodified, where an underflow in the staking precompile writing a post-delegation balance back to the EVM combined with two further upstream bugs. Cosmos Labs had received the vulnerability report in April 2026, judged that production networks were not at risk, and handled the fix through its silent patch process; it later acknowledged that assessment was wrong. Five other chains were drained through the same defect between 20 and 25 August, realising about $5.72m in total.
No party has published a dollar figure for the KiiChain drain itself. What is now known is what the market paid: The Block reports that about 64.6m of the stolen KII — essentially all of the roughly 67.6m that left the chain — sold for around $1.6m, a rate near $0.0248 per token. The figures here apply that market-tested rate to the confirmed token counts: about $3.67m for the full 148.3m taken, and about $2.0m for the 80.7m frozen and recoverable. Both are our own conversions and are labelled as such.
Sources
- AMBCryptoSecondary · retrieved 2026-08-31
- crypto.newsSecondary · retrieved 2026-08-31
- The BlockSecondary · retrieved 2026-08-31
Changes to this entry
- Loss corrected down from $9,846,000 to $3,674,000. The original figure converted the confirmed 148.3m KII at the CoinGecko spot price on the incident day, $0.0664, and described it as a floor. That was wrong in both directions: The Block has since reported that the roughly 64.6m tokens which left the chain sold for about $1.6m, a rate near $0.0248, so spot was a ceiling the market never paid rather than a floor. The token counts are unchanged; the rate applied to them is now the one the sales actually achieved, and the frozen 80.7m is recorded as recovered at the same rate.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "KiiChain (Cosmos EVM precompile) hack — August 2026", iTokenly, accessed 2026-09-09, https://itokenly.com/hacks/kiichain-cosmos-evmhttps://itokenly.com/hacks/kiichain-cosmos-evmPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.