Writing · September 2026
Nobody sent the warning.
Last week I told you to read your vendor's security advisories. This week I want to talk about what happens when nobody writes one. Between August 20 and August 25, attackers drained roughly $5.7 million from six different blockchains using the same bug.
Not six separate attacks on six separate mistakes — one flaw, in one piece of shared code, running underneath all of them.
The code is the Cosmos EVM module. The flaw was in how account balances got reconciled between two systems that each held a different piece of the truth. When a vesting account delegated more than it could actually spend, the write-back did a subtraction nobody had bounded. The balance didn't go negative and fail. It wrapped around to roughly 2256 — a number with no meaning except enormous. Money out of arithmetic. Attackers used it to hollow out high-value addresses on MANTRA, TAC, KiiChain, Nesa and two chains still unnamed.
That's the incident. It isn't the story.
The story is the four months
A researcher reported this bug through the bug bounty on April 25. Cosmos Labs tried to reproduce it, couldn't do so on the most common network configuration, and concluded the exposure was narrow. On August 13 they confirmed what the report had said in April: every chain running the module was vulnerable, regardless of configuration. On August 19 they shipped the fix — through the ordinary public patch process, the one you use for bugs that don't threaten live funds, rather than the private coordinated process reserved for the ones that do.
Then the clock ran out on everybody at once. Eight hours after release, the bug was laid out in public in a pull request on somebody's fork. Twelve hours after that, the first attack landed. The first private notification to affected chains went out roughly eight hours after the attack started. The Hacker News has the full timeline, and it is worth reading slowly.
MANTRA's response named the problem exactly. Twenty hours, they said, was not a realistic window in which to coordinate a state-breaking upgrade across 38 independent validators — particularly with no advisory telling them why it mattered.
I spent years writing guides for people running nodes. The thing I learned is that almost nobody running one is a security team. They're a person with a machine, some uptime obligations, and a deep, unexamined trust that the people upstream will tell them when something is on fire. This month those people got a routine version bump and no explanation, and the market found out before they did.
A patch note is not an advisory. A version bump is not a warning.
Silence is not the same as safety
If you're waiting to be told that something is urgent, you have outsourced the definition of urgent to someone who has already been wrong once. Nothing arriving in your inbox is not evidence that nothing is wrong. It is only evidence that nothing was sent.
In open source, the fix is the disclosure
The moment a patch lands in a public repository, the diff explains the bug to anyone who reads commits — and attackers read commits professionally. There is no such thing as a quiet fix for a critical flaw. There is only a fix that the defenders haven't read yet.
You inherit your upstream's judgment, not just their code
Every operator running that module inherited an April triage call they never saw, never reviewed, and had no way to question. That's the actual dependency. Not the software — the decision-making.
Nobody knew who to call
Cosmos Labs acknowledged it has no complete registry of the networks running its software. If you operate anything, register a security contact upstream, today, and make sure it reaches a human on a weekend. The best advisory in the world is worthless if it's addressed to nobody.
And if you don't run any of this — if you're just someone holding coins — the lesson still lands. You are relying on maintainers you'll never meet to correctly rate the severity of bugs you'll never hear about. That's not a reason for despair. It's a reason not to keep everything in one place, on one chain, behind one team's triage process.
Meanwhile, in the conference hall
The same week this was happening, a group of banks and regulators launched a pilot testing post-quantum signatures for digital asset transfers — NIST-standardized cryptography, on a testnet, with regulators from three jurisdictions observing.
I'm genuinely glad someone is doing that work. Keys have a shelf life, and building codes change. But hold the two stories next to each other. One is a serious, funded, years-out effort to defend against a machine that doesn't exist yet. The other is a subtraction with no bounds check that emptied six chains over five days in August.
The exotic threat gets the panel. The boring one takes the money. It has always been this way, and I don't expect it to change — which is why the unglamorous work is the work: know what you're running, know who maintains it, know how you'd hear if something went wrong, and assume that no news is exactly that.
Verify everything — including the silence.
— Jon Tetreault, September 2026. The habits, tools, and checks behind this piece are what I teach in Crypto Security Mastery.