Nesa Exploit News: How the NES Attack Unfolded Across Cosmos EVM This Nesa Exploit news broke this week after on-chain investigators traced how a single wallet drained about $50M worth of the
This Nesa Exploit news broke this week after on-chain investigators traced how a single wallet drained about $50M worth of the token using a sophisticated balance manipulation bug yet somehow walked away with only about $60K in real profit.
Source: Bubblemaps' investigation thread on X
The gap between the headline number and the actual payout has become the most talked-about part of this incident across crypto research circles.
The root cause traces back to Cosmos Labs, which reported a security bug in its shared Cosmos EVM software — the underlying module used by multiple chains, including Nesa.
Source: Cosmos Labs
Cosmos Labs said an ongoing security incident had impacted users of the Cosmos EVM module and that its security and engineering teams were proactively responding to the situation.
Because many chains are built on this same shared module, the vulnerability was not unique to one project alone.
Investigators identified the main exploiting wallet labeled 0x9AE7 and traced its full playbook as part of this Nesa Exploit news timeline.
Source: @bubblemaps on X
The wallet first bought roughly $250K worth of NES and bridged it onto the Nesa chain. It then exploited the underlying bug to inflate its onchain balance by 200 times before bridging that inflated $50M sum back to Ethereum.
Notably, this wallet was originally funded through Monero, with roughly $45K and $211K in separate transfers routed through privacy tools before reaching addresses connected to the exploit.
Once the tokens were bridged back, the attackerspread them across a wider network of wallets rather than cashing out from one address.
Tokens were swapped for ETH across multiple decentralized exchanges before the resulting funds were deposited into centralized exchanges.
Source: Bubble maps
Several receiving addresses were identified in this fund distribution network, including 0x80c1f107E7929e2440c9E528466776ec7329e89 and 0x9b49E12a68185B9b5cC2EC469E9ef43719f51c7c, among others.
Key steps in the fund movement include:
About $250K in NES purchased and bridged onto the Nesa chain
Balance inflated 200 times through the exploited bug
About $50M worth of tokens bridged back to Ethereum
Tokens routed through multiple wallets and swapped for ETH on DEXs
Resulting ETH deposited across centralized exchanges
Despite draining tens of millions in tokens, the attacker's actual profit came out to just $60K because liquidity was pulled from trading pools quickly once the exploit was detected, forcing later swaps into extreme slippage.
Source: Bubble maps on X
Onerecorded transaction on Etherscan shows this clearly—an aggregated swap attempting to sell 5,000,000 NES worth about $710K returned only about $1,928 worth of ETH, illustrating how thin liquidity had become by the time later swaps executed.
Altogether, the wallet reportedly spent about $255K funding the operation and sold tokens for roughly $315K, leaving a net profit far smaller than the headline figure would suggest.
Detail
Figure
Tokens drained via balance bug
About $50M worth of NES
Initial NES purchase
$250K
Balance inflation multiplier
200x
Total spent on the operation
$255K
Total proceeds from swaps
$315K
Net profit realized
About $60K
NES price drop at worst point
About 90%
The same day this exploit was uncovered, another chain running on Cosmos EVM was separately hit for about $1.4M, though investigators noted differences in how the two sets of attackers were funded and how they operated, suggesting these were likely separate actors rather than one coordinated push.
That second incident involved a chain called KiiChain, which confirmed in its own postmortem that an attacker drained about 148 million KII tokens from wallets on its network on August 22, 2026, repeating a similar exploitation pattern.
NES fell as much as 90% in the immediate aftermath before recovering considerably in the hours that followed.
Source: Details by Bubble maps
Investigators believe the recovery was driven largely by arbitrage activity between mismatched prices on decentralized exchanges and centralized exchanges after the attack.
Market data shows NES trading with a circulating supply of about 141.5 million tokens against a total supply of 1 billion, with a market capitalization sitting well below its fully diluted valuation, reflecting how much of the total supply remains unreleased.
This Nesa Exploit news case is a reminder that even a technically massive exploit does not always translate into a matching payday for the attacker. Fast liquidity removal turned what looked like a $50M theft into a comparatively modest $60K profit, while a parallel incident on another Cosmos EVM chain shows the underlying vulnerability had implications well beyond a single project.
This content is for informational purposes only and is not financial, investment, legal, or tax advice. Cryptocurrency markets are volatile and risky; conduct your own research and consult a qualified professional before making decisions
