Bubblemaps posted on platform X that attackers exploited a vulnerability in the Cosmos EVM shared module to steal $50 million worth of NES tokens, but ultimately only profited about $60,000. Previously, Cosmos Labs reported security vulnerabilities in its shared Cosmos EVM software, affecting multiple chains built on this module, including Nesa.

According to disclosures, the main attacker with an address starting with 0x9AE7 previously spent $250,000 to purchase NES and cross-chain to Nesa Chain, then exploited the vulnerability to inflate the account balance by 200 times and transferred $50 million NES back to Ethereum, with the initial funds coming from Monero. The attacker then dispersed the tokens to multiple wallet addresses, exchanged NES for ETH on a DEX, and deposited the profits into a centralized exchange.

Due to the rapid withdrawal of funds from the liquidity pool, most of the attacker’s exchange transactions encountered severe slippage, resulting in an actual expenditure of $255,000 to initiate the attack, cashing out only $315,000, with a net profit of about $60,000.

Bubblemaps stated that although another Cosmos EVM chain had also suffered a similar attack of $1.4 million the day before, the differences in funding sources and operational methods suggest that the two incidents may have originated from different attackers. The report also mentioned that the price of NES tokens once plummeted by 90%, but has since significantly rebounded, with the team believing that the rebound is mainly due to arbitrage activities caused by price mismatches between DEX and CEX after the attack.