Bubblemaps: Attackers Exploit Vulnerability to Generate $50 Million NES, Ultimately Profiting Only $60,000

BlockBeats News, August 26th, On-chain analysis platform Bubblemaps published a post stating that Cosmos Labs had previously disclosed a security vulnerability in its shared Cosmos EVM software, affecting multiple blockchains using the module, including Nesa.

The main attacker address 0x9AE7 first purchased about $250,000 worth of NES and bridged it to the Nesa Chain. They then exploited a balance flaw to increase the holding by 200 times before bridging back around $50 million worth of NES to Ethereum. The wallet was initially funded with Monero-related funds, and the attacker later dispersed the tokens to multiple addresses, swapped NES for ETH through a DEX, and deposited the funds into a centralized exchange.

Due to rapid liquidity withdrawal from the pool, most of the attacker's trades suffered significant slippage. Bubblemaps stated that the attacker initially invested around $255,000, eventually selling for about $315,000, with a net profit of only about $60,000. The price of NES plummeted by 90% at one point but has since recovered significantly, possibly due to arbitrage opportunities between the DEX and centralized exchange prices post-attack. Another Cosmos EVM project suffered an attack of approximately $1.4 million during the same period, but with a different source of funds and modus operandi, likely carried out by another attacker.