v7.4.0

v7.4.0 — Emergency Recovery & EVM Precompile Fix

This is an off-chain emergency upgrade for kiichain_1783-1, prepared in response to the incident on 22 August 2026. There is no governance proposal for this release — the v7.4.0 binary schedules and applies the recovery plan itself at the announced upgrade height, as soon as every validator restarts with it.

This release:

• Patches the underlying defects in the shared Cosmos EVM module that made the exploit possible.
• Sweeps the remaining balances from the confirmed attacker-controlled addresses into a staging account and redistributes them to the designated recovery wallets.
• Permanently blocks bank sends to or from the attacker addresses (Cosmos, precompile, and EVM-native paths).
• Keeps vesting / permanently-locked account creation disabled, closing the precondition the exploit relied on.

Fund recovery only executes on mainnet; running this same binary on testnet or in a local rehearsal is a safe no-op for that part.

Full validator instructions, including the exact restart procedure, backup steps, and recovery-from-error paths, are here: contrib/docs/upgrade-v7.4.0.md.

What happened

On 22 August 2026, an attacker exploited two chained defects in the shared Cosmos EVM module (not KiiChain-specific application code): an arithmetic underflow in the staking precompile's balance write-back after a delegation, combined with a missing overflow guard on the EVM value-transfer credit path. Together, these allowed the attacker to mint and move native KII that the bank ledger never authorized. Block production was halted immediately upon confirmation to prevent any further funds from leaving the chain.

When it happened

22 August 2026 — incident detected and block production halted the same day. The coordinated restart with v7.4.0 follows once every validator has confirmed the binary and checksum per the instructions linked above.

More information

For the full technical breakdown — install steps with Cosmovisor, how to verify you're on the correct halt height, troubleshooting a wrong AppHash during the upgrade, and what not to do — see the validator upgrade guide:
https://github.com/KiiChain/kiichain/blob/0d768a81f4454c1faf2a562e130541740e7d9ee2/contrib/docs/upgrade-v7.4.0.md

Verify the SHA256 checksum before you install. linux-amd64 is the validator binary.

SHA256

d721a394d09887266a455fe82d05e690171ee2e5850a1a557fb8e0f264a1dc30  kiichaind-v7.4.0-linux-amd64
a4a4a958353e5a63e5ba1c71edbd17b9e7566586f2c91d8d8ded05cd1e0143aa  kiichaind-v7.4.0-linux-arm64
46606f25393410dd66db5341b5e0923fddeab463834088e7acb6274685980fb5  kiichaind-v7.4.0-darwin-amd64
4ab15bfc12ab07a06c99cb0da921f146ef64e9751f57965c4905bb625bcc3ece  kiichaind-v7.4.0-darwin-arm64
2dff8d2417367806c3a773931c065801d67d0547015836c8bcec957394a01266  kiichaind-v7.4.0-darwin-universal

The same checksums are in SHA256SUMS-v7.4.0.txt.

Commit: fbe9a6a57cabc9816ea44c11e93a6c668cac45d2

What's Changed

• feat: add v7.3.1 upgrade for gov module block fix by @mattkii in #369
• fix: block vesting account creation in ante by @mattkii in #371
• feat: Prepare v7.4.0 by @AndresRamirez9912 in #373
• feat: add blacklist for blocked addresses by @mattkii in #372
• chore: bump evm to fork 2 by @jhelison in #374
• fix: Enhance upgrade sweep by @AndresRamirez9912 in #377
• fix: add required read access secret to go modules by @21Chani in #376
• fix: Enhance preblocker upgrade by @AndresRamirez9912 in #378
• chore: Delete v7.3.2 and its reference by @AndresRamirez9912 in #379
• refactor: Add invariants checks on v7.4.0 upgrade process by @AndresRamirez9912 in #380
• fix: Use speandable on sweep attackers funds by @AndresRamirez9912 in #381

New Contributors

• @AndresRamirez9912 made their first contribution in #373
• @21Chani made their first contribution in #376

Full Changelog: v7.3.1...v7.4.0