Cosmos Labs has disclosed that attackers exploited a critical Cosmos EVM vulnerability across six blockchain networks between Aug. 20 and Aug. 25, converting stolen tokens into about $5.72 million in assets through decentralized and centralized exchanges.

Cosmos Labs said in a technical post-mortem published Friday that the flaw had first been reported through its bug bounty program on April 25, nearly four months before the attacks began. Its testers were unable to reproduce the exploit against configurations used by known production Cosmos EVM networks and concluded at the time that live user funds were not at risk.

Based on that assessment, developers handled the vulnerability through a silent public patch instead of privately distributing a security fix to affected chains. Cosmos Labs merged the fix in May without telling network operators which vulnerability it addressed.

The assessment later proved incorrect after independent researchers established in early August that the bug affected all Cosmos EVM chains. Cosmos Labs then obscured the fix to make reverse engineering more difficult and released patched versions at 7:01 p.m. ET on Aug. 19.

Release notes referred to “important” security fixes without describing the vulnerability. The first known attack began at 3:06 p.m. ET on Aug. 20, about 20 hours after the patched software became available.

Cosmos EVM flaw allowed attackers to drain large accounts

The vulnerability involved an integer underflow in Cosmos EVM, the ecosystem’s Ethereum-compatible framework built from the open-source Evmos codebase.

An attacker could first create an account containing locked tokens and delegate more tokens to a validator than the account was able to spend. Subtracting the delegated amount caused the balance to fall below zero, making the value wrap around to the maximum possible figure of 2^256-1 base units.

The attacker could then use the inflated balance against another account. Sending the amount to a target pushed its recorded balance past the same numerical ceiling, causing an overflow that wrapped the value back down and left the attacker holding the target’s tokens.

No additional tokens were created through the process, according to Cosmos Labs, and total token supply remained effectively unchanged. MANTRA said the exploit changed its supply by only one base unit, the smallest divisible denomination of the token.

Cosmos Labs said attackers targeted accounts holding large balances, including burn addresses and multisignature wallets created when networks launched. Its advisory classified the flaw as critical and identified Cosmos EVM releases before v0.6.2 and v0.7.2 as vulnerable.

The incident followed another security disclosure involving Cosmos software earlier this year. Crypto.news previously reported that a researcher had disclosed a CometBFT flaw in April that could cause nodes to stall during block synchronization. The CVSS 7.1 issue did not allow direct asset theft.

Networks had about 20 hours after the patch

Once independent researchers confirmed the Cosmos EVM flaw could affect production chains, Cosmos Labs prepared the security releases that went live on Aug. 19.

Network operators were not given a vulnerability-specific warning explaining what the upgrade fixed. MANTRA later said 20 hours was not enough to assess, build, test and coordinate a state-breaking upgrade across its 38 independent validators.

“Twenty hours was not a realistic window in which to assess, build, test and coordinate a state-breaking upgrade across 38 independent validators, particularly without a vulnerability-specific advisory,” MANTRA wrote in its post-mortem.

Another disclosure occurred before the first theft. At 3:16 a.m. ET on Aug. 20, a Push Chain developer publicly submitted a code change describing the vulnerability and its exploitation path. The filing credited the finding to an audit by security firm Hacken and listed versions considered vulnerable.

The submission said no released version contained the fix, though its version table omitted v0.6.2 and v0.7.2, which Cosmos Labs had published roughly eight hours earlier.

Cosmos Labs described publication of an exact exploitation path by a downstream developer as “highly unusual” and said such disclosures can raise the risk that a vulnerability will be exploited.

MANTRA placed the public security finding 11 hours and 45 minutes before the attacker’s first probe. However, the attacker’s wallet had been funded almost four hours before the finding was filed.

“We state the timing as fact and draw no conclusion from it,” MANTRA said.

A withdrawal of 472.70 MANTRA from a customer account at a centralized exchange funded the gas fees used throughout the attack, according to the network.

MANTRA lost $3.6 million before halting its chain

MANTRA suffered the largest publicly disclosed loss from the attacks, with 720.9 million MANTRA tokens then valued at about $3.6 million taken from two addresses.

One was the network’s burn address. The second was a dormant multisignature wallet left from an earlier incentive campaign.

No automated warning was generated when tokens first moved from the burn address because MANTRA’s monitoring systems treated the address as immovable and did not watch it for outgoing transactions.

The attack remained undetected for almost four hours, giving the attacker time to drain the dormant multisig wallet.

MANTRA halted the network at 7:13 p.m. ET on Aug. 20. About 38 million stolen MANTRA remained frozen in the attacker’s wallet, but 94.7% of the stolen tokens had already been transferred to one centralized exchange deposit address through 15 transactions.

The chain remained unable to process transactions for roughly 30 hours. Crypto.news reported during the interruption that MANTRA halted transactions while engineering and security teams investigated the incident and exchanges suspended deposits and withdrawals.

Validators later deployed patched software and resumed block production without rolling back the chain or altering user balances. Version 8.4.0 included the Cosmos EVM security fix.

MANTRA had added native EVM support to its mainnet in September 2025 alongside CosmWasm compatibility, allowing Solidity applications and Cosmos-native smart contracts to operate on the network.

No stolen MANTRA tokens had been recovered as of Aug. 28, according to the project.

Its circulating supply increased by about 720.9 million tokens because assets held in accounts previously classified as unspendable, including the burn address, became tradable after being moved by the attacker.

TAC and KiiChain were hit after MANTRA

The same method was used against TAC on Aug. 22, according to Cosmos Labs. Nearly 3 billion TAC were taken from the network’s staking pool.

TAC is designed to bring decentralized finance applications to TON and Telegram users. Around 1.2 billion of the stolen tokens were sold on BNB Chain for roughly $950,000.

KiiChain was attacked that evening, losing approximately 148 million KII. About 64.6 million tokens were sold for roughly $1.6 million.

Cosmos Labs estimated that around 54% of the stolen KII remains recoverable onchain if the network is restored.

In its Aug. 23 technical post-mortem, KiiChain criticized how the vulnerability had been communicated to downstream networks. The project said Cosmos Labs did not provide advance notice, identify the release as security critical or initially tell affected chains to halt.

“A patch takes days to review, build, test and roll out across a validator set. A halt takes minutes,” KiiChain wrote. “The only measure that would have contained the risk immediately was a clear instruction to stop producing blocks, and that instruction came after the damage was done.”

Cosmos Labs recommended that vulnerable networks halt on Aug. 22, after MANTRA, TAC and KiiChain had already been hit.

KiiChain disputed part of the technical assessment as well, saying three upstream defects were needed to carry out the exploit and that only the underflow had been publicly patched.

MANTRA reached a different conclusion after testing the fix against a working reproduction of the exploit. Its post-mortem described the underflow repair as “the control that closes this attack path.”

Cosmos Labs described two chained vulnerabilities but did not address KiiChain’s claim that another upstream defect remains unresolved.

Three other Cosmos EVM networks were attacked

Three further chains were exploited with the same method, though Cosmos Labs did not identify them in its report.

Nesa may have been one of the affected networks. Bitvavo suspended NES deposits and withdrawals on Aug. 24, citing a critical consensus vulnerability that had been exploited to make vulnerable nodes accept invalid blocks.

Blockchain analytics firm Bubblemaps identified Nesa as one of the affected chains in an Aug. 26 analysis. The firm said an attacker bought about $250,000 worth of NES, bridged it to Nesa, used the flaw to increase the balance about 200-fold and transferred roughly $50 million in NES back to Ethereum.

Most attempted swaps suffered extreme slippage as liquidity was removed from trading pools, leaving the attacker with about $60,000 in profit, according to Bubblemaps.

The wallet had originally been funded through Monero. Bubblemaps said differences in the funding method and the attacker’s behavior meant a separate party may have been responsible for the Nesa exploit.

The remaining two affected chains have not been publicly identified.

Cosmos Labs said it coordinated with 40 networks during its response and worked with 13 others to patch the vulnerability or halt before they were attacked.

The firm said it does not maintain a complete registry of the more than 115 public blockchains operating across the Cosmos ecosystem. Its response uncovered 11 Cosmos EVM deployments that had not previously been registered with the team.

MANTRA, meanwhile, is being acquired by existing backer Inveniam Capital Partners, which had made a $20 million strategic investment in the project in August 2025. The transaction is expected to close in the third quarter of 2026, with MANTRA Chain, its token and related infrastructure set to continue operating under Inveniam’s ownership.

Crypto projects spent approximately $638 million repurchasing their native tokens between January and Aug. 31, according to Allium Labs figures cited by the Financial Times.

The total increased 17% from the $545 million recorded during the corresponding period in 2025. Projects spent only $366,000 across all of 2024, showing how quickly revenue-funded token repurchases have become part of decentralized finance.

Hyperliquid and Pump.fun accounted for nearly 90% of the 2026 total. Their dominance means the broader increase does not represent uniform adoption across the crypto market.

The annual figure also differs from cumulative buyback totals. Hyperliquid’s reported $1.3 billion covers purchases since its late-2024 launch, while the $638 million figure counts buybacks completed during 2026 by multiple projects.

Hyperliquid dominates crypto token buybacks

Hyperliquid operates the largest revenue-funded repurchase program included in the dataset. The derivatives platform routes 99% of eligible trading fees to its Assistance Fund, according to its protocol documentation.

The system converts trading fees into HYPE through automated purchases executed as part of Hyperliquid’s layer-1 operations. Purchased tokens are then burned, permanently removing them from supply.

Hyperliquid has reportedly bought and cancelled about $1.3 billion in HYPE since launching in December 2024. That cumulative number should not be added to the $638 million annual total because the two figures cover different measurement periods.

HYPE traded near $63.35 on Aug. 31. The token had gained approximately 70% over the previous year, according to the Financial Times. Buybacks may have supported demand, but they cannot be isolated from trading growth, user activity and broader market sentiment.

An earlier examination of Hyperliquid’s automated fee-funded repurchase system found that the Assistance Fund had accumulated roughly 28.5 million HYPE by May. The analysis placed its annualized buyback rate near 7% of market capitalization at the prevailing revenue level.

Pump.fun supplies the second major buyback engine

Pump.fun uses revenue from its token launchpad, PumpSwap exchange and trading products to purchase PUMP. Its current mechanism commits 50% of designated revenue to token buybacks and burns through a locked smart contract.

During the week ending Aug. 9, the platform spent approximately $5.02 million buying and burning 2.15 billion PUMP. Its cumulative program had offset an estimated 15.7% of the token’s original supply by that point.

The purchases have continued alongside scheduled token releases. In July, Pump.fun distributed $86.49 million in vested PUMP to 121 team and investor wallets. Buybacks reduce supply, while unlocks make previously restricted tokens transferable. The two forces therefore work in opposite directions.

PUMP traded near $0.0015 on Aug. 31. Its performance shows why repurchases should not be treated as guaranteed price support. Platform revenue, token unlocks, investor confidence and demand can outweigh the buying program.

Sky and Lido follow different models

Sky Protocol bought approximately $26 million of SKY during 2026, according to Allium’s annual dataset. Its cumulative buyback spending is considerably higher because the Smart Burn Engine began operating before this year.

Sky’s official dashboard describes the mechanism as an onchain system that uses protocol surplus to purchase SKY from the open market. Governance reduced the buyback rate in March by lowering individual purchase sizes and lengthening the interval between transactions.

Sky also says staking rewards are financed through open-market purchases rather than new token issuance. That structure connects protocol surplus with token demand without increasing SKY’s maximum supply.

Lido’s proposed NEST framework is more conditional. Buybacks would activate when annualized revenue exceeds $40 million. The original proposal also required ETH to trade above $3,000, although later discussions considered disabling that separate price floor.

The framework would allocate 50% of staking revenue above the $40 million baseline to LDO purchases. It includes a $50,000 daily limit and a $10 million rolling 12-month cap. These are governance parameters rather than guaranteed spending commitments.

Buybacks cannot guarantee higher token prices

Token buybacks create a recurring buyer and can reduce circulating supply when purchased assets are burned. Unlike corporate shares, however, governance tokens do not necessarily provide ownership, dividends or legal claims over protocol assets.

The effects also depend on execution. Tokens held in a treasury may eventually return to circulation, while permanently burned tokens cannot. Projects may change or discontinue discretionary programs through governance decisions.

Recent results have been mixed. Hyperliquid has combined strong revenue with positive HYPE performance, while several other tokens remained under pressure despite recurring purchases. Crypto analyst Ansem previously argued that buybacks cannot overcome weak community alignment or declining demand.

The next test is whether fee revenue remains strong enough to fund purchases during weaker trading periods. Investors should also track whether repurchased tokens are burned, held or redistributed and compare annual purchases with new emissions and insider unlocks.

The European Central Bank has strengthened its privacy commitments for a potential digital euro as Revolut has begun rolling out its first euro-backed stablecoin, EURR, to selected customers across three European markets.

Forbes reported that the two projects are developing on separate tracks, with the digital euro designed as central bank money while EURR is a privately issued stablecoin intended to maintain a value of one euro.

Digital euro privacy would limit ECB access to user identities

ECB Executive Board member Piero Cipollone said the digital euro would offer the maximum level of privacy that existing technology can support, addressing concerns over how much transaction information a central bank digital currency could expose.

For offline payments, transaction details would only be available to the payer and recipient, Cipollone said. The Eurosystem would not receive information allowing it to identify the people involved in those payments.

Online transactions would operate differently because banks participating in the payment would still need access to customer information for anti-money laundering and other compliance requirements. However, Cipollone said the Eurosystem itself would not be able to identify the users making or receiving the payment.

In practice, the ECB would not be able to directly connect a specific person with a digital euro transaction regardless of whether the payment was made online or offline, according to Cipollone.

“The digital euro guarantees the maximum level of privacy that current technology can offer,” he said.

The privacy framework forms part of a digital euro project that remains under development. In March, crypto.news reported that the ECB expected to publish digital euro technical standards during the summer as payment providers, banks and merchants prepared their systems for a possible rollout.

Cipollone said at the time that a 12-month pilot was scheduled to begin in the second half of 2027, covering person-to-person and point-of-sale payments. The ECB has been working toward technical readiness for possible issuance around 2029, subject to the required European Union legislation.

The digital euro would complement physical cash and bank deposits instead of replacing them, according to the ECB. Private intermediaries such as banks and payment service providers would distribute the currency and provide wallets and related payment services.

Revolut EURR enters three European markets

While the ECB continues developing the digital euro, Revolut has started phased testing of EURR with eligible customers in Denmark, Poland and Portugal.

EURR is Revolut’s first stablecoin and is designed to maintain a value of €1. The token is initially launching on Ethereum, with Revolut planning wider availability across European Economic Area markets later in 2026.

Despite carrying Revolut branding, the token is issued by Bridge Building S.A., part of Stripe-owned stablecoin infrastructure company Bridge. Revolut distributes EURR through its existing platform, giving eligible customers a way to move between fiat currency, crypto assets, external wallets and supported blockchain networks.

Bridge entered the European market with regulatory approvals before the rollout. Crypto.news previously reported in July that the company had secured MiCA and EMI licenses in Luxembourg, allowing it to provide regulated stablecoin and euro payment services across all 27 EU member states.

The company subsequently joined the European Union’s MiCA register as the bloc’s 42nd authorized electronic money token issuer. The Bridge MiCA registration gave the Stripe-owned business a regulated route for issuing euro-backed tokens and providing related payment infrastructure across the bloc.

Revolut said EURR gives customers an on-chain euro option without requiring them to begin with a separate crypto platform. The company already serves more than 75 million customers across more than 40 markets through services covering payments, foreign exchange and crypto.

EURR is fully integrated into the Revolut platform, while stablecoins tied to other currencies are under development. Wider access to the euro token is expected later this year as the company continues its phased rollout.

Euro stablecoins expand under MiCA

Revolut’s entry comes as the supply and number of regulated euro-backed stablecoins have increased under the EU’s Markets in Crypto-Assets framework.

A Decta study covered by crypto.news in July found that the market capitalization of eight MiCA compliant euro stablecoins increased 128% in the year leading up to the end of the EU’s crypto transition period.

Their combined market capitalization rose from $295.6 million on June 30, 2025, to $673.9 million on June 28, 2026. Trading volume across the tokens increased 43.1% from $47 million to $67.3 million over the same period, while the number of compliant euro stablecoins with active market data increased from five to eight.

EURC, EURCV and EURI accounted for much of the increase identified by Decta. Dollar-backed stablecoins remained far larger, with the eight euro tokens covered by the report accounting for less than 1% of the global stablecoin market.

Circle’s EURC has become one of the largest regulated euro tokens. Its circulation passed €400 million in August after more than doubling over the previous year, while total euro stablecoin supply had reached about €650 million by June.

Circle operates EURC as a MiCA-compliant electronic money token through its licensed electronic money institution in France. Eligible Circle Mint customers can redeem the token directly for euros at a one-to-one rate, while the stablecoin has gained support across blockchain networks, exchanges and payment infrastructure.

European banks have been developing competing products. Qivalis, a consortium involving major European financial institutions, selected Fireblocks earlier this year to provide infrastructure for a MiCA-compliant euro stablecoin intended for institutional settlement, treasury operations and tokenized assets.

The digital euro would sit in a different category from EURR, EURC and other privately issued tokens because it would represent a direct liability of the central bank. Private stablecoins depend on their issuer, reserve structure, redemption arrangements and regulatory status.

Under the ECB’s proposed structure, the digital euro could support offline payments while banks continue handling customer-facing services and required compliance checks for online transactions. EURR, meanwhile, gives Revolut customers a euro-denominated asset that can move through blockchain networks and external wallets under Bridge’s regulated issuance structure.

Revolut plans to extend EURR beyond Denmark, Poland and Portugal to other eligible EEA markets later this year, while the ECB’s digital euro project is moving toward its planned 2027 pilot and possible issuance around 2029.

A former White House teleprompter operator has agreed to pay $172,539 after U.S. regulators found he used advance access to President Donald Trump’s speeches to make more than $107,500 trading prediction market contracts.

The Commodity Futures Trading Commission said on Aug. 28 that Gabriel Perez misappropriated material, nonpublic information obtained through his federal government job to trade event contracts for his personal benefit. The settlement requires Perez to return $107,539.02 in profits and pay a $65,000 civil monetary penalty.

Perez has agreed to a three-year trading ban and must cease further violations of the Commodity Exchange Act and CFTC regulations. The $65,000 penalty was substantially reduced under the agency’s new cooperation policy because of what the regulator described as his “exemplary cooperation” during the investigation.

White House access gave Perez advance knowledge of Trump speeches

Between December 2025 and February 2026, Perez worked as a White House teleprompter operator while trading presidential “mention market” contracts, according to the CFTC.

Such contracts are event contracts whose outcomes depend on whether particular words or phrases are used during a presidential speech. Perez’s position gave him access to speeches before Trump delivered them publicly, allowing him to know information directly connected to the contracts he was trading.

The regulator found that Perez used the information in breach of his duty of trust and confidence, generating more than $107,500 in trading profits during the period.

The CFTC credited KalshiEX with assisting its investigation. Perez is no longer employed by the federal government after previously being placed on unpaid leave following scrutiny of his trading activity.

The enforcement action comes as regulators and prediction market operators have been dealing with multiple cases involving traders accused of using information unavailable to the public.

Prediction market insider trading cases have drawn CFTC action

Another federal case centers on U.S. Army Master Sergeant Gannon Ken Van Dyke, who has been accused of using classified military information to trade contracts on Polymarket connected to the operation targeting Venezuelan leader Nicolás Maduro.

As crypto.news previously reported, prosecutors allege Van Dyke made about $409,881 through 13 Venezuela-related trades after putting more than $33,000 into the positions. He pleaded not guilty and has disputed whether the contracts involved legally qualify as swaps.

A federal judge in August stayed the CFTC’s civil enforcement action against Van Dyke until the related criminal proceedings are completed. The case has placed the legal treatment of event contracts and the use of confidential government information in prediction market trading before a federal court.

Kalshi has faced a separate insider-trading episode involving an editor affiliated with YouTube creator MrBeast. In February, the platform imposed a $20,397.58 penalty and a two-year suspension after finding that the editor traded contracts connected to MrBeast content using confidential information.

The MrBeast editor case involved violations of Kalshi’s prohibited insider-trading rules and a failure to cooperate with the investigation. Beast Industries subsequently opened its own investigation and said it had zero tolerance for the misuse of proprietary information.

Scrutiny has since extended to accounts whose trading patterns raise concerns before regulators determine whether a violation occurred. Polymarket referred nearly 100 wallets for further review after an analysis identified trading activity carrying characteristics associated with potentially informed positions.

The review covered signals including newly created wallets, concentrated positions and trades entered shortly before major events. A suspicious designation does not establish that insider trading occurred, and a referral does not mean charges will follow.

Kalshi has expanded controls around prediction markets

Kalshi has introduced several controls intended to identify traders who may have access to confidential information.

In June, the exchange began requiring users in certain higher-risk markets to disclose their employers, giving its compliance team more information to compare a trader’s employment with the subject of a contract. The policy followed a series of cases involving people whose professional positions could give them access to information relevant to market outcomes.

The platform later integrated with StarCompliance, a system used by financial firms to monitor employee trading. Kalshi said the arrangement would allow participating companies to supervise employees’ prediction market activity through compliance systems already used for other financial transactions.

Its trade surveillance controls include a whistleblower reporting channel and a risk-scoring process applied to proposed markets before they are listed. Kalshi has used its own detection engine alongside outside surveillance and integrity services to examine potentially problematic trading behavior.

Regulatory attention has extended past insider trading. The CFTC in August reminded regulated entities offering event contracts that pricing information must clearly identify the products as contracts traded on a regulated exchange. Agency staff warned that displaying the products using American-style sportsbook odds could mislead customers about the nature of the transaction.

CFTC authority over event contracts remains under legal scrutiny

The Perez order treated the presidential mention contracts as event contracts, or swaps, under federal commodities law. The classification places his use of nonpublic government information within the CFTC’s enforcement framework under the Commodity Exchange Act.

At the same time, the scope of federal authority over prediction markets remains the subject of court disputes involving Kalshi and several U.S. states.

New York, Nevada and other states have challenged contracts offered through federally regulated prediction markets, particularly products tied to sports. Kalshi and the CFTC have argued in several proceedings that federally regulated event contracts fall within the commission’s jurisdiction, while state authorities have maintained that some products operate as gambling and remain subject to state law.

The CFTC used emergency authority in August to direct KalshiEX to continue normal operations after New York sought restrictions against the exchange. The agency said federal derivatives law gives it exclusive jurisdiction over event contracts traded on registered exchanges, while courts have reached different conclusions over the extent to which federal law preempts state gambling rules.

A separate regulatory dispute has spread across multiple states, with the CFTC filing actions or participating in proceedings involving state attempts to regulate prediction market contracts.

For Perez, the CFTC’s Aug. 28 settlement resolves the federal enforcement action without removing the financial consequences of the trades. He must surrender the full $107,539.02 generated from the activity, pay the discounted $65,000 penalty and remain out of CFTC-regulated trading for three years.