KiiChain Security Incident: What Happened and What Comes Next
KiiChain Security Incident: How the Staking Exploit Unfolded
KiiChain Security Incident published its full incident report, and it fills in a lot of the picture that was missing when the network first went dark.
In short, someone found a way to trick the chain's staking system into thinking they had far more money than they actually did and then quietly walked off with roughly 148 million KII across 18 separate rounds before the team caught on and pulled the plug.
The good news buried in all of this is that most of the damage is still fixable. Here's how it played out, told plainly and in order.
The Short Version
On 22 August 2026, an attacker found a weak spot in how KiiChain's system tracks balances between its Cosmos side and its Ethereum-style (EVM) side.
Source: KiiChainio on X
They exploited it 18 times, hitting a different wallet each time, before the KiiChain team spotted the unusual activity and froze the entire chain at block 9,355,723—22:50:58 UTC. That halt is what stopped things from getting worse.
The team has since figured out exactly how the attack worked, tested a fix, and confirmed it closes the gap. And importantly, this wasn't a bug KiiChain's own developers wrote—it lives inside a piece of shared code called the Cosmos-EVM module, used by several different blockchains.
That's also why two other chains, Mantra and TAC, got hit by nearly the identical trick that same week.
Source: Document of KiiChain Security Incident
How the Attacker Actually Pulled It Off
This is the clever—and frustrating—part. Normally, there's no way to exploit this bug from a regular wallet, because the system simply won't let you "delegate" (stake) more money than you actually have. So the attacker had to build a workaround:
They calculated, in advance, what address a new smart contract would be deployed to
Before deploying anything, they turned that future address into a special "vesting" account
Then they deployed their exploit contract onto that same address, so the contract inherited the vesting account's status
From there, they delegated one wei (a tiny fraction of a token) more than the contract could actually afford
That tiny overreach triggered an underflow—basically, the system's math broke and wrapped around to a nonsensical, enormous number instead of throwing an error
They then chained two more bugs on top of that to pull real funds from victim wallets onto their own contract
One reassuring detail: this couldn't be used to print money out of thin air. Every single drain was capped at whatever the victim's real balance actually was.
The Timeline of Events
Stage | What Happened | Status |
Stage 1 — Setting the trap | The attacker creates a hidden gap between their real balance and what the system thinks they have, using the chained bugs described above | Confirmed |
Stage 2 — Moving the money out | 67,597,997.87 KII bridged off KiiChain to BNB Smart Chain through Hyperlane | Confirmed |
Stage 3 — Cashing out | 64,597,997.87 KII sold for BUSD/USDT through a PancakeSwap pool on BSC; the remaining 3,000,000 KII sent to a KuCoin deposit address instead of being sold | Confirmed |
Stage 4 — Getting caught | KiiChain's team spots the abnormal drains, halts the chain, and reaches out to KuCoin to freeze the deposit | In progress |
Why This Was Preventable — And Who Dropped the Ball
This is arguably the most important part of the whole report. The underlying bug wasn't a surprise to everyone—Cosmos Labs, the team behind the shared code, actually pushed a fix for part of the problem days before the KiiChain security incident was ever hit. The issue is how that fix was handled afterward.
Date | Event | What Went Wrong |
Wed 19 Aug | Cosmos Labs quietly pushes a fix for the underflow bug to a public code repository | No heads-up to the chains actually using this code, no security warning, nothing flagging it as urgent |
Fri 21 Aug | Cosmos Labs finally tells affected chains—but buries it inside an unrelated batch of routine updates | By now the fix had been sitting in public for two days, meaning anyone paying attention could reverse-engineer the exploit. Still no urgency attached |
Fri 21 Aug | Mantra Chain gets hit | The danger was no longer theoretical, yet nobody raised the alarm further |
Sat 22 Aug | TAC gets hit, then KiiChain gets hit and halts at 22:50:58 UTC | If a "stop your chain now" warning had gone out after Mantra, this likely would never have happened. |
Sat 22 Aug (later) | Cosmos Labs finally recommends that chains halt | By this point, three separate chains had already lost funds |
The report makes a simple but important point here: patching code properly takes days—writing it, testing it, and getting validators to roll it out safely. But telling a chain to just stop producing blocks takes minutes.
That one warning, sent early enough, would have protected everyone. It didn't go out until after the damage was already done.
Where the Stolen Funds Actually Went
Here's the part people care about most—how much of the 148 million KII can realistically come back.
Fund Disposition | Amount (KII) | % of Total | Status |
Total stolen | 148,326,583.15 | 100.0% | — |
Still sitting on KiiChain | 80,728,575.06 | 54.4% | Recoverable once the chain restarts |
Bridged off to BNB Smart Chain | 67,597,997.87 | 45.6% | Mostly gone |
— Sold for BUSD/USDT on BSC | 64,597,997.87 | 43.6% | Already sold and scattered across wallets |
— Sent to a KuCoin deposit | 3,000,000.00 | 2.0% | Freeze requested, waiting on confirmation |
What the attacker actually pocketed | ~1,607,323.41 BUSD | — | Realized value from the sold portion |
So more than half the stolen tokens never actually left KiiChain—they're just sitting frozen in the attacker's wallets, waiting to be swept back by the upcoming upgrade.
The chunk that made it to BNB Smart Chain and got sold is essentially gone.
The one remaining shot at recovering something off-chain is the 3 million KII sitting in a KuCoin account, if the exchange agrees to freeze it.
The Root Cause, In Plain Terms
To be clear about where the blame sits: this wasn't a mistake in anything KiiChain's own engineers built.
It's a flaw in a piece of shared infrastructure — the Cosmos-EVM module — that multiple independent blockchains rely on. Two separate arithmetic bugs had to work together for the attack to succeed: the underflow described earlier, plus a second bug the team isn't disclosing publicly yet for security reasons (presumably so it can't be copied before every affected chain patches it).
Only the underflow has actually been fixed upstream so far—meaning any other chain that applied just that one public patch is still sitting exposed to the rest.
What KiiChain Has Already Done
Halted the chain immediately at block 9,355,723 to stop any further losses
Notified the community, exchanges in crypto, and validators through X, Discord, and Telegram, and asked exchanges to pause KII deposits and withdrawals
Identified and reproduced the exact exploit path, tracing it back to a specific transaction at block 9,355,102
What's Still Coming
A proper fix that makes the system throw an error instead of silently wrapping around when the math goes negative
A speed limit on the Hyperlane bridge—capped at 10 million KII per rolling 24 hours—so any future exploit would be a slow trickle instead of an instant drain
A one-time migration that moves the recoverable 80.7M KII back into designated recovery wallets
A permanent block on the five wallets and contracts tied to the attacker, stopping them from moving funds ever again
The Checklist Before the Chain Comes Back Online
KiiChain Security Incident isn't restarting until every one of these boxes is checked.
Gate | Who's Responsible | How It's Verified |
Fixes are merged and built into the upgrade | Engineering | Confirmed in place |
Tests confirm the exploit no longer works | Engineering | Passes automated testing |
Fund-recovery migration matches the plan exactly | Engineering | Tested on a copy of the real chain state |
Attacker wallets and contracts are blocked | Engineering | Confirmed rejected in test environment |
A full dry run works end-to-end | Engineering | The chain produces blocks normally, no issues |
All validators are running the same upgrade | Operations | Confirmed aligned on binary and timing |
Exchanges know when service resumes | Business Development | Deposit/withdrawal plan confirmed |
Because the chain isn't producing blocks, the usual on-chain voting process can't run either—so validators are coordinating the restart directly with each other instead, agreeing on one exact block height where everyone switches to the fixed version at once.
Wrapping Up
The short version of a long story: a bug nobody at KiiChain Security Incident wrote let an attacker walk away with 148 million KII, but over half of it never actually left the chain and should come back once the fixed version goes live.
The portion that made it to another blockchain and got sold is mostly a loss, apart from a small slice still waiting on an exchange to act.
And the bigger lesson here isn't really about KiiChain's code at all—it's about how a security fix sat out in the open for two days without anyone sounding the alarm, giving an attacker just enough time to find it first.
YMYL Disclaimer
This article is for informational and educational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile and carry risk. Always do your own research before making any investment decisions.
