Cosmos EVM attackers sold roughly $2.85 million through CEXs after a patchable flaw unlocked vested tokens, exposing lingering holder risks.