Nesa: the "$50 million" exploit that cashed out at about 109 ETH, into KuCoin

Nesa is a Cosmos EVM chain. The bug, patched quietly by Cosmos Labs on 19 August, let an attacker underflow a vesting account’s EVM balance and use the wrapped value to take another account’s real balance. MANTRA was hit on 20 August, TAC and KiiChain on 22 August, Nesa on 24 August. Nesa’s own nodes and explorer went down, so the only record anyone can read is Ethereum’s: a Hyperlane delivery minting 257,703,733 NES to 0x9AE755D23Fc948fE94C9364A2398fd508a2AB0d2, the address rekt.news and the researcher Rarma identify as the attacker’s.

Before any of that, the same address was funded with 105.75 ETH through the Mayan Swift bridge, between 02:59 and 03:45 UTC on 24 August, and spent 105.02 ETH of it through CoW Swap buying NES — the roughly 1.1 million NES the attacker then deposited into Nesa to trigger the bug. Whatever the bridged NES was worth on paper, the attacker was already 105 ETH in.

The minted NES was split. The primary address passed 170.3 million NES to a second wallet, 0xB92dF70F3d25eD25265c7C341C9D2550c42Ff83A, and sold some itself through CoW Swap, 1inch and other aggregators. An hour earlier it had sent 5 million NES each to four fresh wallets — 0x231Bff3C…, 0x20cD837c…, 0x80c17107… and 0x9b49E12a…, the last two first published by Bubblemaps. Three passed their NES straight on to the selling wallet; 0x231Bff3C… sold about 3.5 million through CoW Swap first and sent the selling wallet 11.18 ETH with the rest. Both main wallets burned NES as well — 26.1 million and 45.3 million — at least part of it as a Hyperlane transfer back toward Nesa that the halted chain never received.

Counting every ETH that came back from those sales: about 71 ETH on the primary address, about 25 ETH on the selling wallet, and 12 ETH more returned by a helper wallet — roughly 109 ETH in all, against the 105 ETH spent to begin with. At about $2,750 an ETH that is some $300,000, not $50 million.

On 25 August the primary address sent 108.7 ETH to 0x2816039940Fd2ea2eCAfce843CB2cC39E73f3fD6, which passed 110 ETH to 0x83C85C3C045aeDEBd81a678a3FFD52794Af6B414. That address paid four deposit addresses at KuCoin the same morning, and KuCoin swept them into its own hot wallets. An exchange deposit is the one point in this trace where the chain meets an identified account.

0x83C85C3C… also received about 104,000 USDC and 52 ETH on 21 August — three days before Nesa, one day after MANTRA. That is a lead, not a finding: we have not tied those funds to the MANTRA attacker, and this page does not claim they are.

One smaller branch went elsewhere. At 14:01 UTC on 24 August the primary address sent 500,000 NES to 0x5d4de48E97f9255C43193515b2B354e399f997B6, which forwarded it ten minutes later to a ChangeNOW hot wallet. Its gas came from ChangeNOW’s own sweep address: it is a ChangeNOW deposit, created for one swap. At 14:14, a zero-value transfer to a look-alike address, 0x5d4d3e94…97B6, appeared in the attacker’s history — somebody else’s address-poisoning bot, trying the attacker as a victim.

The attacker’s eight wallets in this trace — the primary, the selling wallet, the four relays and the two consolidation hops — are labelled in PublicAML. The KuCoin and ChangeNOW deposit addresses are not: they belong to the exchanges.