Bubblemaps said an attacker exploited a flaw in the shared Cosmos EVM module to steal NES tokens worth about $50 million, yet the trade outcome was far smaller than the headline number suggests. According to the disclosure, the main attacker first spent $250,000 to buy NES, bridged the tokens to Nesa Chain, used the bug to inflate the account balance by 200x, and then bridged roughly $50 million worth of NES back to Ethereum. The wallet’s original funding source was identified as Monero.
The attacker later split the tokens across multiple wallets, swapped NES for ETH on decentralized exchanges, and moved the proceeds to a centralized exchange. Bubblemaps said liquidity was pulled from the pool quickly, causing severe slippage across most of the swaps. As a result, the attack cost about $255,000 to execute and generated only $315,000 in cash-out value, leaving an estimated net profit of roughly $60,000.
Bubblemaps also noted that another Cosmos EVM chain suffered a similar $1.4 million attack a day earlier, but differences in funding sources and tactics suggest the two incidents may not be linked. The report added that NES plunged as much as 90% before rebounding sharply, which the team attributed mainly to arbitrage driven by DEX and CEX price dislocations after the exploit.
Bubblemaps said on X that an attacker exploited a vulnerability in the shared Cosmos EVM module to steal NES tokens worth $50 million, but ultimately made only about $60,000 in profit.
Cosmos Labs had previously reported a security flaw in its shared Cosmos EVM software. Multiple chains built on that module were affected, including Nesa.
How the attack was carried out
According to the disclosure, the main attacker was a wallet address starting with 0x9AE7. That address spent $250,000 to buy NES and bridged the tokens to Nesa Chain. The attacker then used the vulnerability to inflate the account balance by 200x and bridged $50 million worth of NES back to Ethereum.
The report said the wallet’s initial funding came from Monero. After moving the tokens back, the attacker split them across several wallet addresses, swapped NES for ETH on DEXs, and later deposited the proceeds into a centralized exchange.
Slippage erased most of the gains
Because liquidity was pulled from the pool quickly, most of the attacker’s swap transactions ran into severe slippage. Bubblemaps said the attacker spent $255,000 in total to launch the exploit and cashed out only $315,000, for an estimated net profit of about $60,000.
Another Cosmos EVM chain saw a similar exploit
Bubblemaps also said another Cosmos EVM chain was hit by a similar $1.4 million attack the previous day. Based on differences in funding sources and operating methods, the two incidents may have involved different attackers.
NES fell 90% before rebounding
The report added that NES at one point dropped 90% and later recovered sharply. The team said the rebound was mainly driven by arbitrage after a pricing mismatch opened up between DEXs and CEXs following the attack.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
