Cosmos EVM Critical Flaw Drained $5.7M

A critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. Cosmos Labs has warned that the vulnerability, designated GHSA-7g4w-cg88-2cq2, affects versions < 0.6.2 and >= 0.7.0 < 0.7.2.

Patches were released in versions 0.6.2 and 0.7.2 on August 19. The company's post-mortem, published August 28, states the flaw was reported through its bug bounty program on April 25. At that time, Cosmos Labs assessed it as posing no risk to funds on live networks.

"We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks," Cosmos Labs said. The team confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration.

Vulnerability and Exploitation Path

The flaw exists in code reconciling Ethereum Virtual Machine (EVM) state with the Cosmos SDK x/bank module. A vesting account delegating more than its spendable balance triggers an unchecked subtraction, causing the balance to wrap to roughly 2^256. Reconciliation then mints on a positive delta and burns on a negative one.

An attacker could move funds from the wrapped account or send a victim account 2^256 minus its balance, causing reconciliation to burn the victim's real holdings. Exploitation requires the chain to permit permissionless vesting-account creation.

Patch Distribution and Incident Timeline

After confirming the universal risk on August 13, Cosmos Labs routed the fix through its public silent patch process, reserved for issues not causing fund loss on production chains. The company said it concluded this was safe because the patch was already publicly available without known exploitation.

This contradicted its own published policy. "When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs," the policy states.

A public pull request in Push Chain's fork described the exploit path in detail at 07:16 UTC on August 20. The first attack, against MANTRA, began at 19:06 UTC. Cosmos Labs sent its first private notification by secure email at 03:36 UTC on August 21, roughly two hours after MANTRA reported its exploitation.

Mitigation Steps and Downstream Actions

Operators are advised to upgrade to v0.6.2 or v0.7.2 in a coordinated, state-breaking network upgrade. Chains that cannot upgrade immediately are told to halt block production. There is no configuration-only mitigation.

Downchain teams took different approaches. ZetaChain contributor morde08 noted a cherry-picked patch left the fork's live path unpatched. Warden Protocol blocked vesting-account creation outright two days later.

Cosmos Labs said it is aware of six exploited chains. Attackers sold approximately $2.87 million in affected assets on decentralised exchanges based on August 19 prices, a figure supplied by the affected chains and not independently audited. A further $2.85 million was sold on centralised exchanges, based on public volume data. The company holds no complete registry of networks running its software, a gap that also impacted responses to bundled filesystem flaws in July. The release notes for v0.6.2 and v0.7.2 omit the security backport from their changelogs.