Cosmos EVM Vulnerability Drained Funds from 6 Blockchains
Critical flaw was exploited despite Cosmos Labs' awareness, causing $2.87M in losses.
1Critical Vulnerability and Impact
A balance-handling flaw in the Cosmos EVM module led to fund drainage across six blockchains between August 20-25, 2026. Designated GHSA-7g4w-cg88-2cq2, the vulnerability was rated Critical by Cosmos Labs. Affected versions included 0.6.2 and versions between 0.7.0 and 0.7.2. Fixes were released in v0.6.2 and v0.7.2 on August 19, but these updates required state-breaking changes, necessitating coordinated network upgrades by operators.
2Discovery and Initial Misassessment
Cosmos Labs revealed the flaw was reported through its bug bounty program on April 25 and initially assessed as posing no risk to live network funds. The team couldn't reproduce the vulnerability on 18-decimal networks and incorrectly concluded it only affected non-18-decimal networks. By August 13, they confirmed all Cosmos EVM chains were vulnerable regardless of decimal configuration.
3Patch Process Shortcomings
Despite knowing the vulnerability threatened user funds, Cosmos Labs used its silent patch process. The company's own policy requires emergency mitigations for such flaws. Because the patch was already publicly available on the main branch, they proceeded silently. This decision ultimately facilitated the attacks that followed.
4Technical Details of the Flaw
The vulnerability existed in code reconciling EVM state with Cosmos SDK's x/bank module. While EVM StateDB tracks only spendable balance, SDK vesting accounts hold both spendable and locked balances. When a vesting account delegated more than its spendable balance, an unchecked subtraction caused balance wrapping to ~2^256. This allowed attackers to manipulate funds through reconciliation mint/burn mechanisms.
5Attack Timeline and Responses
The first attack targeted MANTRA blockchain at 19:06 UTC on August 20. Cosmos Labs sent its first private notification via secure email at 03:36 UTC on August 21. Approximately $2.87 million in affected assets were sold on decentralized exchanges during the attacks. Different chains responded differently - Warden Protocol blocked vesting-account creation entirely, while ZetaChain implemented all three fixes.
6Patch Transparency Issues
v0.6.2 and v0.7.2 release notes mentioned important security fixes but omitted specific backports from changelogs. Cosmos Labs disclosed it had silently patched 37 vulnerabilities in the past 13 months. However, this time, detailed exploit path descriptions in a public pull request made attackers' jobs easier.
7Recommendations for Operators
Cosmos Labs advises operators to upgrade to v0.6.2 or v0.7.2 immediately. Those unable to upgrade should halt their chains. Operators should also review permissions for vesting-account creation. Blockchain projects using Cosmos EVM must reevaluate their security policies and patch management processes, as this incident highlights critical vulnerabilities in shared modules.
8Key Lessons for the Industry
This incident underscores the importance of robust security processes in blockchain ecosystems. More transparent and proactive approaches are needed for critical vulnerability disclosure and patch distribution. The event particularly highlights the urgent need for industry-wide standards in managing vulnerabilities in shared modules. Cosmos Labs' response demonstrates the need for revised security incident management protocols across the sector.
Original article: The Hacker News — Cosmos EVM Güvenlik Açığı 6 Blockchain'de Fon Kaybına Yol Açtı