$50 million NES bridged from Nesa to Ethereum in security incident
An attacker bridged 257.7 million NES from Nesa to Ethereum, resulting in a loss of approximately $50 million. The incident is linked to a known vulnerability affecting other platforms in the Cosmos EVM ecosystem.
Our full investigation: Nesa: the "$50 million" exploit that cashed out at about 109 ETH, into KuCoin
The incident involved an attacker bridging 257.7 million NES, which is valued at roughly $50 million, from the Nesa platform to Ethereum. The specific mechanism used for the attack was not disclosed by Nesa, but it is noted to be consistent with vulnerabilities that have previously impacted other projects in the Cosmos EVM ecosystem, including MANTRA, TAC, and KiiChain.
Bubblemaps estimated that slippage during the bridging process reduced the net profit from the attack to about $60,000. This suggests that while the initial amount bridged was substantial, the effective gain for the attacker was significantly lower due to market conditions at the time of the transaction.
The incident highlights the risks associated with bridging assets between different blockchain networks, especially when vulnerabilities are present in the underlying technology. The lack of detailed information about the mechanism used in this case leaves some aspects of the incident unclear.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0x9AE755D23Fc948fE94C9364A2398fd508a2AB0d2 | ETH | mentioned in coverage | Check live |
| 0xB92dF70F3d25eD25265c7C341C9D2550c42Ff83A | ETH | mentioned in coverage | Check live |
| 0x231Bff3C5FcE5c61d1055CaE3a20B460EfF13901 | ETH | mentioned in coverage | Check live |
| 0x20cD837cb50DB8DED885Fe3e799A2355D08A213F | ETH | mentioned in coverage | Check live |
| 0x80c17107E7929e2440c9E528466776ec71329e89 | ETH | mentioned in coverage | Check live |
| 0x9b49E12a68185B9b5cC2EC469E9ef43719f51c7c | ETH | mentioned in coverage | Check live |
| 0x2816039940Fd2ea2eCAfce843CB2cC39E73f3fD6 | ETH | mentioned in coverage | Check live |
| 0x83C85C3C045aeDEBd81a678a3FFD52794Af6B414 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.
