KiiChain Security Incident: How the Staking Exploit Unfolded KiiChain Security Incident published its full incident report, and it fills in a lot of the picture that was missing when the netw
KiiChain Security Incident published its full incident report, and it fills in a lot of the picture that was missing when the network first went dark.
In short, someone found a way to trick the chain's staking system into thinking they had far more money than they actually did and then quietly walked off with roughly 148 million KII across 18 separate rounds before the team caught on and pulled the plug.
The good news buried in all of this is that most of the damage is still fixable. Here's how it played out, told plainly and in order.
On 22 August 2026, an attacker found a weak spot in how KiiChain's system tracks balances between its Cosmos side and its Ethereum-style (EVM) side.
Source: KiiChainio on X
They exploited it 18 times, hitting a different wallet each time, before the KiiChain team spotted the unusual activity and froze the entire chain at block 9,355,723—22:50:58 UTC. That halt is what stopped things from getting worse.
The team has since figured out exactly how the attack worked, tested a fix, and confirmed it closes the gap. And importantly, this wasn't a bug KiiChain's own developers wrote—it lives inside a piece of shared code called the Cosmos-EVM module, used by several different blockchains.
That's also why two other chains, Mantra and TAC, got hit by nearly the identical trick that same week.
Source: Document of KiiChain Security Incident
This is the clever—and frustrating—part. Normally, there's no way to exploit this bug from a regular wallet, because the system simply won't let you "delegate" (stake) more money than you actually have. So the attacker had to build a workaround:
They calculated, in advance, what address a new smart contract would be deployed to
Before deploying anything, they turned that future address into a special "vesting" account
Then they deployed their exploit contract onto that same address, so the contract inherited the vesting account's status
From there, they delegated one wei (a tiny fraction of a token) more than the contract could actually afford
That tiny overreach triggered an underflow—basically, the system's math broke and wrapped around to a nonsensical, enormous number instead of throwing an error
They then chained two more bugs on top of that to pull real funds from victim wallets onto their own contract
One reassuring detail: this couldn't be used to print money out of thin air. Every single drain was capped at whatever the victim's real balance actually was.
Stage
What Happened
Status
Stage 1 — Setting the trap
The attacker creates a hidden gap between their real balance and what the system thinks they have, using the chained bugs described above
Confirmed
Stage 2 — Moving the money out
67,597,997.87 KII bridged off KiiChain to BNB Smart Chain through Hyperlane
Confirmed
Stage 3 — Cashing out
64,597,997.87 KII sold for BUSD/USDT through a PancakeSwap pool on BSC; the remaining 3,000,000 KII sent to a KuCoin deposit address instead of being sold
Confirmed
Stage 4 — Getting caught
KiiChain's team spots the abnormal drains, halts the chain, and reaches out to KuCoin to freeze the deposit
In progress
This is arguably the most important part of the whole report. The underlying bug wasn't a surprise to everyone—Cosmos Labs, the team behind the shared code, actually pushed a fix for part of the problem days before the KiiChain security incident was ever hit. The issue is how that fix was handled afterward.
Date
Event
What Went Wrong
Wed 19 Aug
Cosmos Labs quietly pushes a fix for the underflow bug to a public code repository
No heads-up to the chains actually using this code, no security warning, nothing flagging it as urgent
Fri 21 Aug
Cosmos Labs finally tells affected chains—but buries it inside an unrelated batch of routine updates
By now the fix had been sitting in public for two days, meaning anyone paying attention could reverse-engineer the exploit. Still no urgency attached
Fri 21 Aug
Mantra Chain gets hit
The danger was no longer theoretical, yet nobody raised the alarm further
Sat 22 Aug
TAC gets hit, then KiiChain gets hit and halts at 22:50:58 UTC
If a "stop your chain now" warning had gone out after Mantra, this likely would never have happened.
Sat 22 Aug (later)
Cosmos Labs finally recommends that chains halt
By this point, three separate chains had already lost funds
The report makes a simple but important point here: patching code properly takes days—writing it, testing it, and getting validators to roll it out safely. But telling a chain to just stop producing blocks takes minutes.
That one warning, sent early enough, would have protected everyone. It didn't go out until after the damage was already done.
Here's the part people care about most—how much of the 148 million KII can realistically come back.
Fund Disposition
Amount (KII)
% of Total
Status
Total stolen
148,326,583.15
100.0%
—
Still sitting on KiiChain
80,728,575.06
54.4%
Recoverable once the chain restarts
Bridged off to BNB Smart Chain
67,597,997.87
45.6%
Mostly gone
— Sold for BUSD/USDT on BSC
64,597,997.87
43.6%
Already sold and scattered across wallets
— Sent to a KuCoin deposit
3,000,000.00
2.0%
Freeze requested, waiting on confirmation
What the attacker actually pocketed
~1,607,323.41 BUSD
—
Realized value from the sold portion
So more than half the stolen tokens never actually left KiiChain—they're just sitting frozen in the attacker's wallets, waiting to be swept back by the upcoming upgrade.
The chunk that made it to BNB Smart Chain and got sold is essentially gone.
The one remaining shot at recovering something off-chain is the 3 million KII sitting in a KuCoin account, if the exchange agrees to freeze it.
To be clear about where the blame sits: this wasn't a mistake in anything KiiChain's own engineers built.
It's a flaw in a piece of shared infrastructure — the Cosmos-EVM module — that multiple independent blockchains rely on. Two separate arithmetic bugs had to work together for the attack to succeed: the underflow described earlier, plus a second bug the team isn't disclosing publicly yet for security reasons (presumably so it can't be copied before every affected chain patches it).
Only the underflow has actually been fixed upstream so far—meaning any other chain that applied just that one public patch is still sitting exposed to the rest.
Halted the chain immediately at block 9,355,723 to stop any further losses
Notified the community, exchanges in crypto, and validators through X, Discord, and Telegram, and asked exchanges to pause KII deposits and withdrawals
Identified and reproduced the exact exploit path, tracing it back to a specific transaction at block 9,355,102
A proper fix that makes the system throw an error instead of silently wrapping around when the math goes negative
A speed limit on the Hyperlane bridge—capped at 10 million KII per rolling 24 hours—so any future exploit would be a slow trickle instead of an instant drain
A one-time migration that moves the recoverable 80.7M KII back into designated recovery wallets
A permanent block on the five wallets and contracts tied to the attacker, stopping them from moving funds ever again
KiiChain Security Incident isn't restarting until every one of these boxes is checked.
Gate
Who's Responsible
How It's Verified
Fixes are merged and built into the upgrade
Engineering
Confirmed in place
Tests confirm the exploit no longer works
Engineering
Passes automated testing
Fund-recovery migration matches the plan exactly
Engineering
Tested on a copy of the real chain state
Attacker wallets and contracts are blocked
Engineering
Confirmed rejected in test environment
A full dry run works end-to-end
Engineering
The chain produces blocks normally, no issues
All validators are running the same upgrade
Operations
Confirmed aligned on binary and timing
Exchanges know when service resumes
Business Development
Deposit/withdrawal plan confirmed
Because the chain isn't producing blocks, the usual on-chain voting process can't run either—so validators are coordinating the restart directly with each other instead, agreeing on one exact block height where everyone switches to the fixed version at once.
The short version of a long story: a bug nobody at KiiChain Security Incident wrote let an attacker walk away with 148 million KII, but over half of it never actually left the chain and should come back once the fixed version goes live.
The portion that made it to another blockchain and got sold is mostly a loss, apart from a small slice still waiting on an exchange to act.
And the bigger lesson here isn't really about KiiChain's code at all—it's about how a security fix sat out in the open for two days without anyone sounding the alarm, giving an attacker just enough time to find it first.
This article is for informational and educational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile and carry risk. Always do your own research before making any investment decisions.
