Cosmos Labs Tells All EVM Chains to Halt

gm, Defiers!

These are the biggest stories in DeFi and crypto:

Cosmos Labs told every public chain running its EVM module below v0.6.2 or v0.7.2 to halt on Tuesday morning. Three chains that run it — MANTRA, TAC and KiiChain — had already been drained between Aug. 20 and Aug. 22, and two of them are still frozen.

KiiChain has put the only numbers on the damage. An attacker took 148 million KII, worth roughly $9.7 million, repeating the same technique 18 times against different targets before the chain halted. Cosmos Labs has published no security advisory. The v0.6.2 and v0.7.2 release notes carry boilerplate about "important security fixes" with no CVE, no advisory reference, and nothing identifying a live exploit path.

KiiChain says the upstream fix is partial: only the underflow has been patched, and two of the three defects that had to line up remain open. The XRPL EVM sidechain still pins a fork of v0.6.1, below the floor Cosmos Labs named, and was producing blocks normally on Tuesday afternoon.

Read more below!

BLOCKCHAINS

Cosmos Labs Urges EVM Chains To Halt

Cosmos Labs recommended on Tuesday that any public blockchain running a Cosmos EVM module below v0.6.2 or v0.7.2 "immediately halt the blockchain and upgrade." The recommendation reaches an unknown number of networks sharing one open-source codebase. KiiChain's incident report says three upstream defects had to line up: an underflow in the staking precompile, plus two bugs it says are still undisclosed. The attacker computed the address its exploit contract would deploy to, converted that address into a vesting account, then deployed the contract onto it. The contract inherited vesting status, delegated one wei more than its spendable balance, and underflowed its mirrored EVM balance to roughly 2^256. Total supply was never inflated. Of the 148 million KII taken, 80.7 million sits in addresses the halt immobilized; 64.6 million was bridged to BNB Smart Chain and sold for about 1.61 million BUSD. TAC lost 2,985,651,403 tokens, roughly 62% of circulating supply, and is still down 66 hours on. MANTRA is back on a patched v8.4.0 binary and has published no post-mortem.

Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three NetworksThe recommendation came six days after the patch shipped without a security advisory. KiiChain, one of three chains drained, says the sequence cost it 148 million tokens and that two of the three underlying defects remain unfixed upstream.thedefiant.io

Why this matters: Cosmos Labs shipped the fix to a public repo on Aug. 19 and told downstream chains two days later. KiiChain says that window is when it was robbed.

PARTNER

Join us Sept 24: The Current State of Blockchain, Crypto, and Fintech

Join Sophia Zhao, Partner at Alumni Ventures, and Camila Russo, Founder of The Defiant, for a fireside conversation on the current state of blockchain, crypto, and fintech venture — where capital is deploying across the space, what the next generation of on-chain and financial infrastructure companies are actually building, and how accredited investors can gain structured exposure to one of the most active corners of private markets.

Save my seat →

DEFI

Coinbase Launches Tokenized Stocks On Base

Coinbase's tokenized US equities went live on Base on Monday, putting NVDAc, METAc, AAPLc and GOOGLc onchain as transferable tokens eligible non-US users hold in a self-custodial wallet. Combined onchain value reached about $4.55 million late Monday against roughly $3.06 million of DEX liquidity and $10.8 million of 24-hour volume. Pricing tracked the underlying closely: NVDAc changed hands at $208.51 against Nvidia's $208.48 close, AAPLc at $311.23 against Apple's $310.34. Aerodrome holds the deepest pool for all four, with $957,307 behind NVDAc. The issuer is Coinbase Onchain SPV Ltd, incorporated in Abu Dhabi Global Market on June 17, with SEC-registered broker-dealer Alpaca Securities buying and custodying the shares in segregated accounts. Creation costs 1 basis point of the invested amount and redemption 5. The prospectus warns that one token does not permanently equal one share — a multiplier scales each claim as dividends reinvest and splits apply. Tokenized public equities are a $2.48 billion market, with Ondo ahead at $872.7 million.

Why this matters: Token holders get no vote unless they clear KYC into the legal register, and unvested holders cannot redeem. Coinbase's US customers still cannot buy any of it.

DEFI

Pendle Oracle Move Liquidates $36 Million

Trades in a thinly traded Pendle yield market triggered $36.1 million of liquidations on Morpho early Tuesday, closing 33 leveraged positions in about 14 minutes while lenders came out whole. The Pendle reUSD pool maturing Dec. 10 holds $8.97 million of liquidity; the Morpho market accepting its principal tokens as collateral held $67.5 million against $52.2 million of borrows at a 91.5% liquidation threshold. Borrowers looped to health factors of 1.03 were carrying under a 3% buffer. PeckShield said a wallet market-bought reUSD yield tokens, pushing the implied yield to 20%, then dumped the position. Onchain analyst 0scar reconstructed the sequence and put realized gains at "at least $360k," saying the liquidator and the yield-token buyer are the same entity because the liquidator paid the buyer's gas. Pendle said the oracle "was set up correctly and functioned as intended." Steakhouse Financial pulled liquidity from the affected markets and restored it. Realized bad debt is zero. A forum user flagged the size mismatch on Aug. 17.

Why this matters: The market pricing the collateral was seven times smaller than the debt it backed, and the numbers sat in a public GraphQL query eight days early.

MARKETS

Bitcoin Stalls a Cent Below $80,000

Bitcoin touched $79,999.99 on Coinbase on Monday before easing, its highest level since May 15, on a four-session rally whose catalysts all predate the weekend. It last changed hands at $78,995, up 1.8% over 24 hours and 22.9% over seven days, with turnover down to $128 billion from $158 billion on Friday. Breadth turned negative underneath: total crypto market value fell 0.7% while 80 of the 123 largest non-stablecoin tokens declined. Last week's leaders gave back the most — Ethena's ENA fell 7.5% after an 84.6% week, Pump.fun's PUMP 8.9% against 67.4%, Aave 5.8% after 53.7%. US spot bitcoin ETFs took in $307.5 million on Friday for a $1.92 billion week, a fifth straight day of inflows. Grayscale's Zcash trust converts to an NYSE Arca ETF under ZCSH on Tuesday, and Fed Chair Kevin Warsh speaks at Jackson Hole this week.

Why this matters: Bitcoin rose while most of the market fell, and nothing dated lands before Jackson Hole. Polymarket puts a September quarter-point increase at 30.5%.

BLOCKCHAINS

LayerZero Unveils ATLAS Exchange Engine

LayerZero introduced ATLAS on Tuesday, an exchange engine on its Zero blockchain that hands matching, clearing, settlement and risk management to third-party trading venues and ships with no frontend of its own. Venues keep 20% to 65% of the trading fee depending on how much ZRO they stake and how much volume they route; rebate tiers scale to a stake of 1% of total supply. Of what remains, 25% goes to whoever created the market being traded and 75% buys and burns ZRO. ZRO traded at $1.29 at 16:01 UTC, up 12.5% on the day and 63% over the week, off the $0.71 all-time low it set on July 31, for a $454 million market cap. LayerZero claims sub-millisecond median latency, 1.418 milliseconds at the 95th percentile, and provisioning for 200,000 transactions per second — every figure from a test environment. Zero has not reached mainnet and ATLAS has no launch date.

Why this matters: Every performance number comes from a test environment on a chain that has not shipped, and the fee burn only starts once venues actually route volume.