Verify a decision

{"actor":"system:backfill","investigation_id":"b6f50e9d-9fe7-454d-b6fa-4f999bb9ae36","kind":"publish","page_slug":"nesa-nes","published_at":"2026-09-16T17:09:51.135Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Nesa (NES)","sections":[{"content":"On August 24, 2026, an attacker exploited an integer-underflow vulnerability in the shared cosmos/evm module — used by Nesa and several other Cosmos-based chains — to withdraw 257,703,733 NES (approximately 25.8% of stated circulating supply, valued at roughly $50 million at the time) from the Nesa chain via the Hyperlane bridge to Ethereum. According to on-chain analytics firm Bubblemaps and reporting by rekt.news, the attacker first purchased approximately $250,000 of NES and bridged it onto the Nesa chain, then exploited the underflow bug — caused by vesting accounts delegating locked coins through the EVM staking precompile, which wrapped the EVM-visible balance toward 2^256 — to inflate their on-chain balance roughly 200x before bridging the inflated balance out. The attacking address was reportedly funded via Monero. NES's price fell as much as 90% in the immediate aftermath before partially recovering. Despite the scale of tokens moved, the attacker's realized profit was limited to approximately $60,000 (spending roughly $255,000 and recovering about $315,000) because extreme slippage set in as liquidity was pulled from NES trading pools during the sell-off; Bubblemaps traced roughly 185.7 million NES sold across 241 fills via CoW Protocol and Uniswap V4, with proceeds subsequently split across eight wallets.","heading":"August 2026 Cosmos EVM Exploit","severity":"critical","sources":[{"credibility":2,"name":"rekt.news — Nesan (Nesa exploit writeup)","type":"news_article","url":"https://rekt.news/nesa-rekt"},{"credibility":2,"name":"KuCoin News — Attackers exploit vulnerability to generate $50M NES, profiting only $60K","type":"news_article","url":"https://www.kucoin.com/news/flash/attackers-exploit-vulnerability-to-generate-50m-nes-profit-only-60k"},{"credibility":3,"name":"Bubblemaps (@bubblemaps) on X — investigation thread into the $50M NES exploit","type":"social_media","url":"https://x.com/bubblemaps/status/2092613204396650888"},{"credibility":2,"name":"TronWeekly — Cosmos EVM Exploit Hits Nesa, KiiChain, TAC, And MANTRA","type":"news_article","url":"https://www.tronweekly.com/cosmos-evm-exploit-hits-nesa-kiichain-tac-and/"},{"credibility":2,"name":"Protos — Cosmos Labs under fire over disclosure of bug affecting four blockchains","type":"news_article","url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/"}]},{"content":"The vulnerability exploited against Nesa was not unique to its codebase but resided in the shared Cosmos EVM module maintained by Cosmos Labs, which also affected MANTRA Chain (alleged loss of approximately $3.6 million), TAC (alleged loss of approximately $950,000–$7.5 million depending on source), and KiiChain (alleged loss of over 148 million KII tokens, sold for roughly $1.6 million). Total losses across the affected chains were reported at roughly $5.7 million net of slippage, against a much larger gross/nominal figure. Cosmos Labs subsequently acknowledged that a researcher had reported the underlying integer-underflow flaw as early as April 25, 2026, but that its own testers were unable to reproduce the attack against live-chain configurations and wrongly concluded funds were not at risk; a silent patch was deployed without an accompanying security advisory. Cosmos Labs has stated the patch was released only approximately 20 hours before the attacks began across the affected chains, leaving insufficient time for downstream chains such as Nesa to apply defenses. This establishes that a substantial share of the risk originated in third-party infrastructure rather than negligence unique to Nesa's own development team, though Nesa's choice to build on and remain dependent on this shared module is itself a risk factor for the project.","heading":"Vendor-Level Root Cause and Cosmos Labs' Disclosure Failure","severity":"high","sources":[{"credibility":2,"name":"The Block — Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":2,"name":"TronWeekly — Cosmos EVM Exploit Hits Nesa, KiiChain, TAC, And MANTRA","type":"news_article","url":"https://www.tronweekly.com/cosmos-evm-exploit-hits-nesa-kiichain-tac-and/"},{"credibility":2,"name":"Protos — Cosmos Labs under fire over disclosure of bug affecting four blockchains","type":"news_article","url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/"}]},{"content":"Following the exploit, Nesa's own public disclosure was described by rekt.news as \"notably sparse\": the team stated only that it had identified malicious behavior, without publishing technical detail, a loss figure, attacker wallet addresses, or an explanation of the exploitation mechanism, even as peer chains MANTRA, KiiChain, and TAC published more detailed disclosures of the damage to their own networks. As of September 8, 2026, Nesa's public blockchain explorer remained offline and returned no usable block data, which prevented independent, outside verification of on-chain transactions, balances, and state changes related to the incident. Nesa later characterized the exploit as \"pre-meditated operations\" without adding further technical specifics. On September 7, 2026, Nesa announced deployment of a revised NES token contract and began migrating exchange listings to the new contract addresses, an operational response to the security incident. Binance Wallet separately announced a 1:1 contract swap for NES holdings recorded before the August 24, 2026 halt (14:51 UTC), with refund arrangements for net-buyers during the trading halt window.","heading":"Post-Incident Transparency Concerns","severity":"medium","sources":[{"credibility":2,"name":"rekt.news — Nesan (Nesa exploit writeup)","type":"news_article","url":"https://rekt.news/nesa-rekt"},{"credibility":2,"name":"KuCoin News — Nesa Deploys Revised NES Token Contract to Exchanges; Migration Ongoing","type":"news_article","url":"https://www.kucoin.com/news/flash/nesa-deploys-revised-nes-token-contract-to-exchanges-migration-ongoing"}]},{"content":"Nesa describes itself as a Layer-1 blockchain intended to enable verifiable, privacy-preserving on-chain AI inference, positioned as an alternative to centralized AI platforms, and connects to the wider Cosmos ecosystem via IBC. Public sources identify Marco Di Maggio and Patrick Colangelo as co-founders. Di Maggio is a finance academic who held positions at Columbia Business School and Harvard Business School before becoming a Full Professor of Finance at Imperial College Business School; secondary sources describe him as having served as an \"External Researcher\" with Terra Money from 2018 to 2020, applying economic research to stablecoin and DeFi applications — a research-advisory role rather than an executive one, and distinct from Terra/Luna's 2022 stablecoin collapse, which is not reported to directly implicate Di Maggio. No court filings, regulatory actions, or fraud allegations tied personally to Di Maggio or Colangelo were identified in this research. The NES token, with a stated genesis supply of 1 billion tokens, launched via Binance Alpha around June 24, 2026, with Nesa's mainnet reported to have launched around May 9, 2026. No independent, verifiable security audit report for Nesa's own chain code was identified in this research; this absence should be treated as a gap in available information rather than confirmation that no audit exists.","heading":"Project Background and Team","severity":"low","sources":[{"credibility":3,"name":"IQ.wiki — Marco Di Maggio","type":"research","url":"https://iq.wiki/wiki/marco-di-maggio"},{"credibility":3,"name":"Bitget Academy — What Is Nesa (NES)? The Layer-1 Blockchain for Trusted AI","type":"other","url":"https://www.bitget.com/academy/what-is-nesa-nes-layer-1-ai-how-it-works-tokenomics"}]}],"sources_used":[{"credibility":2,"name":"rekt.news — Nesan (Nesa exploit writeup)","type":"news_article","url":"https://rekt.news/nesa-rekt"},{"credibility":2,"name":"The Block — Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":2,"name":"KuCoin News — Attackers exploit vulnerability to generate $50M NES, profiting only $60K","type":"news_article","url":"https://www.kucoin.com/news/flash/attackers-exploit-vulnerability-to-generate-50m-nes-profit-only-60k"},{"credibility":2,"name":"KuCoin News — Nesa Deploys Revised NES Token Contract to Exchanges; Migration Ongoing","type":"news_article","url":"https://www.kucoin.com/news/flash/nesa-deploys-revised-nes-token-contract-to-exchanges-migration-ongoing"},{"credibility":2,"name":"TronWeekly — Cosmos EVM Exploit Hits Nesa, KiiChain, TAC, And MANTRA","type":"news_article","url":"https://www.tronweekly.com/cosmos-evm-exploit-hits-nesa-kiichain-tac-and/"},{"credibility":2,"name":"Protos — Cosmos Labs under fire over disclosure of bug affecting four blockchains","type":"news_article","url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/"},{"credibility":3,"name":"Bubblemaps (@bubblemaps) on X — investigation thread into the $50M NES exploit","type":"social_media","url":"https://x.com/bubblemaps/status/2092613204396650888"},{"credibility":3,"name":"IQ.wiki — Marco Di Maggio","type":"research","url":"https://iq.wiki/wiki/marco-di-maggio"},{"credibility":3,"name":"Bitget Academy — What Is Nesa (NES)? The Layer-1 Blockchain for Trusted AI","type":"other","url":"https://www.bitget.com/academy/what-is-nesa-nes-layer-1-ai-how-it-works-tokenomics"},{"credibility":3,"name":"BBX — Nesa launches on Binance Alpha","type":"other","url":"https://bbx.com/article/541217"}],"summary":"Nesa is a Cosmos-based Layer-1 blockchain marketed as infrastructure for verifiable, privacy-preserving AI, with its NES token launched via Binance Alpha in mid-2026. On August 24, 2026, an attacker exploited an integer-underflow vulnerability in the shared Cosmos EVM module to inflate a NES balance roughly 200x and bridge approximately $50 million worth of tokens (25.8% of stated supply) out via Hyperlane to Ethereum, crashing the NES price as much as 90% before a partial recovery; extreme slippage limited the attacker's realized profit to roughly $60,000. The same vendor-level bug hit MANTRA, TAC, and KiiChain in the same window, and Cosmos Labs has since admitted it wrongly cleared the underlying flaw months earlier; Nesa's own post-incident transparency has drawn separate criticism for withholding technical detail that peer chains disclosed.","timeline":[{"date":"2026-05","event":"Nesa mainnet reported to have launched, with 1 billion NES tokens created at genesis.","source":"WebSearch aggregation of secondary crypto-wiki sources","source_url":"https://www.bitget.com/academy/what-is-nesa-nes-layer-1-ai-how-it-works-tokenomics"},{"date":"2026-06","event":"NES token launched via Binance Alpha.","source":"BBX / secondary reporting","source_url":"https://bbx.com/article/541217"},{"date":"2026-04","date_original":"2026-04-25","event":"A security researcher reported the Cosmos EVM integer-underflow vulnerability to Cosmos Labs; Cosmos Labs' testers were unable to reproduce the exploit against live-chain configurations and wrongly concluded funds were not at risk.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"date":"2026-08","date_original":"2026-08-22","event":"Attackers exploit the Cosmos EVM vulnerability against KiiChain and TAC, draining roughly 148 million KII and roughly 3 billion TAC tokens (valued around $7.5 million) respectively.","source":"Protos","source_url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/"},{"date":"2026-08","date_evidence":"On Aug. 24, an attacker used the same Cosmos EVM vulnerability chain that had already hit MANTRA, TAC, and KiiChain to withdraw 257,703,733 NES from Nesa through Hyperlane to Ethereum, about 25.8% of the token's stated supply.","date_original":"2026-08-24","event":"Attacker exploits the Cosmos EVM underflow bug on Nesa, withdrawing 257,703,733 NES (~$50M, ~25.8% of stated supply) via Hyperlane to Ethereum; Nesa halts its chain and Binance Wallet later offers a 1:1 contract swap for pre-halt holdings.","source":"rekt.news / Protos","source_url":"https://rekt.news/nesa-rekt"},{"date":"2026-08","date_original":"2026-08-24","event":"Cosmos Labs issues a public warning urging Cosmos EVM chains to halt and apply the security patch, roughly 20 hours after the patch's release.","source":"Protos","source_url":"https://protos.com/cosmos-labs-under-fire-over-disclosure-of-bug-affecting-four-blockchains/"},{"date":"2026-08","date_original":"2026-08-29","event":"Cosmos Labs publicly acknowledges it wrongly cleared the underlying bug after an earlier report, and discloses the incident's total impact across six chains at approximately $5.7 million net.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"date":"2026-09","date_original":"2026-09-07","event":"Nesa announces deployment of a revised NES token contract and begins migrating exchange listings to updated contract addresses.","source":"KuCoin News","source_url":"https://www.kucoin.com/news/flash/nesa-deploys-revised-nes-token-contract-to-exchanges-migration-ongoing"},{"date":"2026-09","date_original":"2026-09-08","event":"Nesa's public blockchain explorer remains offline, showing no usable block data and 0% reported uptime, preventing independent verification of on-chain exploit details.","source":"rekt.news","source_url":"https://rekt.news/nesa-rekt"}]},"v":1}