Today’s Field Note

The Cosmos ecosystem had a bad day, twice. Cosmos Labs admitted it wrongly cleared the bug behind a $5.7 million six-chain exploit; MANTRA Chain, which lost $3.6 million of that, says the patch landed only 20 hours before the attack began and did not even address the flaw. Separately, Layer 1 Fogo halted its mainnet after an attacker received 400 million FOGO (10% of circulating supply, roughly $3 million) and paused the chain to contain it. The through-line is that “audited” and “patched” mean nothing when the disclosed patch does not match the actual vulnerability, and a validator set fast enough to halt is a validator set centralized enough to halt. Treat any shared IBC or cross-chain module code as suspect until the specific CVE is public.

Today’s Move

  • If you hold FOGO or have funds bridged to Fogo, assume withdrawals are frozen and do not chase deposits until mainnet resumes with a public post-mortem.
  • Exit or reduce exposure to MANTRA (OM) bridge routes and any of the six affected chains until Cosmos Labs names the exact module and commit hash.
  • Revoke approvals on IBC-connected front ends and cross-chain contracts you interacted with in the last week; re-grant only after fixes are confirmed.
  • Watch the Fogo attacker address and MANTRA exploiter flows for movement toward CEX deposit addresses or Tornado-style mixers.
  • Builders: audit shared Cosmos SDK / IBC middleware directly rather than trusting the “cleared” advisory, and pin to a version after the real fix, not the 20-hour-prior one.

Resources

  • https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061
  • https://www.theblock.co/news/defi/2026-08-29-layer-1-blockchain-fogo-halts-mainnet-after-attacker-receives-400-million-fogo-tokens-10-of-circulating-supply-413064
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.