Cosmos Labs: Shared Cosmos EVM Vulnerability Exploited on Six Chains, $5.7M Taken

Cosmos Labs said a vulnerability in its shared Cosmos EVM software module was exploited across six blockchain networks, generating roughly $5.7 million in realized proceeds, in a case the company says was made worse by an earlier mis-triage of the bug. In its post-mortem, Cosmos Labs framed the incident not just as a code flaw, but as a failure in risk assessment, patch coordination and ecosystem-wide disclosure.

“Between August 20, 2026, 19:06 UTC, and August 25, 2026, 15:20 UTC, attackers exploited a vulnerability in Cosmos EVM to steal funds from multiple Cosmos-based blockchains,” the company said. The flaw is tracked in GitHub advisory GHSA-7g4w-cg88-2cq2 as a “Balance underflow in EVM StateDB.” The advisory said affected releases were “< 0.6.2, >= 0.7.0 < 0.7.2” and patched releases were “>= 0.6.2, >= 0.7.2.” Cosmos Labs said patched versions v0.6.2 and v0.7.2 were made available on Aug. 19.

Cosmos EVM is a shared upstream module that gives Cosmos SDK blockchains compatibility with Ethereum-style smart contracts. That shared design helps many independent chains add the same functionality quickly, but it also means a single upstream bug can spread risk across multiple networks at once. Cosmos Labs said that is what happened here: one flaw in a common component exposed several chains that relied on it.

Cosmos Labs estimated the attackers realized about $2.87 million through on-chain decentralized exchange trades and another $2.85 million through sales on centralized exchanges, for total realized proceeds of roughly $5.72 million based on Aug. 19 prices. The company said those figures were not independently audited.

The root cause, according to Cosmos Labs, was a bug in balance handling in the shared module: an unchecked unsigned-integer underflow tied to the staking precompile, combined with an overflow technique that let attackers move real tokens without proper ledger authorization. At a high level, the issue allowed balances to be manipulated in a way the system should have rejected.

Three affected chains have publicly confirmed incidents, though Cosmos Labs said six networks were exploited in total. MANTRA Chain said “The attacker moved 720,923,967.99 MANTRA from two addresses that had not authorised the transactions.” MANTRA valued the moved tokens at about $3.6 million at the pre-incident price, halted the chain and later resumed on patched binary v8.4.0.

TAC said an attacker exploited the Cosmos EVM precompile layer on Aug. 22 and moved 2,985,651,403 TAC from one account before the chain was halted at block 24,671,475. “This was a drain, not a mint,” TAC said, adding that total supply was unchanged.

KiiChain said that on Aug. 22, an attacker exploited two chained defects in the shared Cosmos EVM module and drained 148,326,583.15 KII. The project said the attack was repeated 18 times before validators halted the chain at block 9,355,723. Several affected chains halted block production as an immediate mitigation step.

The post-mortem also lays out a disclosure timeline that points to process failures before the attacks began. Cosmos Labs said the bug was first reported through its bug bounty program on April 25 by security researcher @AshmitSh4rma, who is credited in the advisory, with additional researchers later providing reproduction details. The company initially assessed the issue as low risk for production configurations and used a “silent patch” process rather than a broader public alert. Its post-mortem said that mis-triage contributed to chains remaining exposed.

Cosmos Labs said the broader impact became clear only later as it worked to coordinate patches and outreach across an ecosystem that included chains not fully registered in its security channels. The Aug. 19 releases included state-breaking fixes, raising the operational burden for downstream networks that had to upgrade.

The company said attacker-linked centralized exchange accounts used in the cash-out have been frozen pending investigation by relevant authorities, and that it is coordinating with law enforcement. Cosmos Labs also said it is changing its security review and coordinated-disclosure processes in response to the incident.