reported drained across 18 targets
KiiChain incident report; incident reconstructionKiiChain: Cosmos EVM Balance Exploit
KiiChain reported 18 drains exploiting shared Cosmos EVM balance accounting. Follow the film from prepared vesting accounts to the BNB Chain sales, and see why a network halt could only contain funds that had not left.
- Date
- August 22, 2026
- Network
- KiiChain / BNB Chain
- Reported amount
- 148.3M KIIreported drained across 18 targets
- What happened
- Vesting-account balance exploit, followed by bridge transfers and sales
- Status
- Halt and recovery measures reported; actor identity not established here
- This file rests on
- 0 recorded and 12 reported statementsacross 1 linked identifiers
12 chapters · choose one to jump the film to it
Replay it yourself.
These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.
Eighteen drains
One repeated sequence targeted wallets across KiiChain. The reported token amount is different from the money later realized by selling it.
Reported by others- KiiChain reported 148,326,583.15 KII taken across 18 attacks on August 22, 2026.KiiChain incident report; incident reconstruction
Two networks
The film follows activity on KiiChain and BNB Chain. They are separate ledgers, even where an address has the same hexadecimal spelling.
Reported by others- The film reconstructs initial funding from BNB Chain to KiiChain through Hyperlane.Forensia case-study film reconstruction
Prepare an account, then deploy
The attacker prepared a vesting account at a future contract address, then deployed a helper there. Vesting means some funds are locked to a schedule.
Reported by others- The incident reconstruction identifies a 2 KII vesting-account setup, helper deployment, drain and sweep sequence.Incident transaction reconstruction
The balance-accounting failure
Delegating beyond the spendable balance made the EVM balance wrap to an enormous number. A second arithmetic failure let real victim balances be redirected.
Reported by others- Cosmos Labs describes linked underflow and overflow defects, with no net increase in token supply in the exploit transaction.Cosmos Labs post-mortem, August 28, 2026
Repeat the sequence
The film steps through setup, deployment, drain, sweep and bridge activity. A reconstruction of selected sequences is not an independent count of all targets.
Reported by others- KiiChain reported that the technique was repeated against 18 targets.KiiChain incident report; incident reconstruction
Follow the BNB side
The next part follows reported bridge receipts on BNB Chain. Open the address on that network to inspect the records currently available.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The film shows bridge activity and KII arriving on BNB Chain; this page does not independently match every cross-chain message.Forensia case-study film reconstruction
Token value versus sale proceeds
Selling into a market changes the price. Multiplying every stolen token by its earlier quote does not establish what the seller received.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- The film reconstructs approximately 1.607 million USDT from the reviewed BNB Chain sales. This is a film-reported result, not an independently reproduced total on this page.Forensia case-study film reconstruction
The proceeds branch out
The film follows outgoing transfers after the sales. A recipient is a transaction counterparty; that alone does not identify the person behind it.
Reported by othersOpens a live lookup on the Graph view. Today’s capture may differ from the film’s.- The film depicts proceeds distributed across multiple recipients, including repeated 50,000 USDT transfers.Forensia case-study film reconstruction
A later, larger drain
A later reconstructed sequence uses the same setup and delegation pattern against another target.
Reported by others- The incident reconstruction records a 42,178,466.002176081424538812 KII victim debit in transaction 4FC1440E411EEF245BB6111E7D72F89F4883FE4022C7D7B0E60A36D2A1E3DB84.KiiChain incident reconstruction
What the halt contained
Stopping block production contained tokens still on KiiChain. Tokens already bridged away required a separate response.
Reported by others- KiiChain reported 80,728,575.06 KII remaining on-chain at the halt and 67,597,997.87 KII bridged out. These are reported figures, not a reconciled ledger reproduced here.KiiChain incident report; incident reconstruction
The shared-code response
The vulnerability affected shared Cosmos EVM infrastructure. The film compares the disclosure and patching accounts; those are external statements.
Reported by others- Cosmos Labs acknowledged that its initial assessment incorrectly excluded fund-loss risk on production configurations.Cosmos Labs post-mortem, August 28, 2026
Read the available records
The film ends with a bounded Forensia lookup. Missing historical activity or a missing public label does not establish that nothing happened or identify an owner.
Reported by othersOpens a live lookup on the Summary view. Today’s capture may differ from the film’s.- The case-study film shows a BNB Chain lookup with limited returned history. Fresh results can differ from that recording.Forensia case-study film; recording date not independently established
What the headline said. What a closer reading shows.
sale proceeds reconstructed in the case-study film, not the nominal token valuation
Forensia case-study film; not independently reproduced hereThe incident on one map
Who called what, and where it went.
Recorded in the workspaceReported by others
In the order it happened.
The incident reconstruction places the first reviewed vesting-account setup here.Reported by others
The first reviewed drain is followed by a helper-to-receiver sweep.Reported by others
A later reconstructed drain debits approximately 42.18 million KII.Reported by others
KiiChain reports a halt at block 9,355,723.Reported by others
Cosmos Labs publishes its post-mortem of the shared-module vulnerability.Reported by others
The cast
Open the investigation ↗Every address and transaction in this case.
Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.
Where it went
Addresses that received the value. Who controls them is not established here.
- Reported receiving address on BNB ChainBNB Chain address
The BNB Chain address followed in the case-study film and research. This opens a fresh, bounded BNB lookup, not the native KiiChain exploit or proof of the operator’s identity.
Two kinds of statement, kept apart.
This case follows the case-study film and incident research. Its figures are labelled as reported; this page does not claim a fresh, independently retained Forensia capture. Native KiiChain execution is outside the current workspace coverage. The investigation links open the BNB Chain address, and current results may differ from the recording. Native KiiChain transactions and full Hyperlane settlement are not independently verified by this page. Reported recovery is separate from assets actually returned; no person is identified.
What the chain records0
No independently retained chain capture is attached to this case. Linked records and source reports are available above; workspace coverage is stated for this case.
What others have reported12
- Step 1
KiiChain reported 148,326,583.15 KII taken across 18 attacks on August 22, 2026.KiiChain incident report; incident reconstruction
- Step 2
The film reconstructs initial funding from BNB Chain to KiiChain through Hyperlane.Forensia case-study film reconstruction
- Step 3
The incident reconstruction identifies a 2 KII vesting-account setup, helper deployment, drain and sweep sequence.Incident transaction reconstruction
- Step 4
Cosmos Labs describes linked underflow and overflow defects, with no net increase in token supply in the exploit transaction.Cosmos Labs post-mortem, August 28, 2026
- Step 5
KiiChain reported that the technique was repeated against 18 targets.KiiChain incident report; incident reconstruction
- Step 6
The film shows bridge activity and KII arriving on BNB Chain; this page does not independently match every cross-chain message.Forensia case-study film reconstruction
- Step 7
The film reconstructs approximately 1.607 million USDT from the reviewed BNB Chain sales. This is a film-reported result, not an independently reproduced total on this page.Forensia case-study film reconstruction
- Step 8
The film depicts proceeds distributed across multiple recipients, including repeated 50,000 USDT transfers.Forensia case-study film reconstruction
- Step 9
The incident reconstruction records a 42,178,466.002176081424538812 KII victim debit in transaction 4FC1440E411EEF245BB6111E7D72F89F4883FE4022C7D7B0E60A36D2A1E3DB84.KiiChain incident reconstruction
- Step 10
KiiChain reported 80,728,575.06 KII remaining on-chain at the halt and 67,597,997.87 KII bridged out. These are reported figures, not a reconciled ledger reproduced here.KiiChain incident report; incident reconstruction
- Step 11
Cosmos Labs acknowledged that its initial assessment incorrectly excluded fund-loss risk on production configurations.Cosmos Labs post-mortem, August 28, 2026
- Step 12
The case-study film shows a BNB Chain lookup with limited returned history. Fresh results can differ from that recording.Forensia case-study film; recording date not independently established
Reports behind this case.
Share and cite
Take the case with you.
The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.