A critical vulnerability in the shared Cosmos EVM module — the open-source component enabling Cosmos SDK-based blockchains to run Ethereum-compatible smart contracts — was exploited across six networks between August 20 and August 25, 2026, draining approximately $5.72 million in aggregate. The f...
"Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit." — KiiChain, Post-Mortem Report (August 2026)
A critical vulnerability in the shared Cosmos EVM module — the open-source component enabling Cosmos SDK-based blockchains to run Ethereum-compatible smart contracts — was exploited across six networks between August 20 and August 25, 2026, draining approximately $5.72 million in aggregate. The flaw, an unsigned-integer underflow in the balance-reconciliation layer between the EVM StateDB and the Cosmos SDK x/bank module, had been reported to Cosmos Labs through its bug bounty program on April 25. Engineers initially assessed it as non-threatening to production networks. That assessment held for four months. It was wrong.
The incident represents one of the clearest supply-chain failures in blockchain infrastructure to date: a single shared dependency, maintained by one organization, silently carrying a critical defect across dozens of independent networks. When the fix was finally released on August 19, it was published in a public repository without advance private notification to downstream chains. Active exploitation began within 12 hours.
The flaw sits in code that reconciles Ethereum Virtual Machine state with the Cosmos SDK's x/bank module. The Cosmos EVM StateDB tracks only an account's spendable balance, but vesting accounts in SDK state hold both a spendable and a locked balance. When a vesting account delegates an amount exceeding its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction is unchecked. The balance wraps to approximately 2^256 — effectively infinite.
The exploit combined two accounting failures: (1) an unsigned-integer underflow that created an abnormally large balance, and (2) a state overflow allowing attackers to extract legitimate balances from downstream accounts without increasing total token supply. The vulnerability existed within Cosmos EVM versions prior to v0.6.2 and v0.7.2, affecting the vesting accounts logic, staking operations, balance handling, and the EVM precompile layer.
Cosmos Labs designated the advisory as ASA-2026-002 and rated it Critical, though it was published without a CVE identifier, weakness classification, or CVSS score.
The vulnerability was first reported through Cosmos Labs' bug bounty program on April 25, 2026. Engineers tested the exploit against six-decimal token configurations and determined it affected only those networks. Since production Cosmos EVM chains uniformly use 18-decimal configurations, the team concluded the defect posed no risk to live user funds.
According to Cosmos Labs' own post-mortem, published August 28: "Based on that assessment, Cosmos Labs addressed the vulnerability through its silent, public patch process rather than the private patch distribution process used when a vulnerability is believed to threaten live user funds."
A fix was merged into the main codebase on May 15 via pull request #1176, followed by an additional balance correction in PR #1187 on May 20. Neither was flagged as security-critical. Neither triggered downstream notifications.
On August 13, further analysis confirmed all Cosmos EVM chains were affected regardless of decimal configuration. Six days later, on August 19, patched releases v0.6.2 and v0.7.2 shipped.
The timeline: 111 days elapsed between the initial bug report and the confirmed universal exposure. Another six days passed before patches shipped. The first exploit occurred within 12 hours of the public release.
Cosmos Labs' stated security policy requires private fix distribution before public release when a vulnerability threatens live user funds. That step was skipped.
The fix shipped in v0.6.2 and v0.7.2 on August 19, published in a public GitHub repository. Cosmos Labs gave no advance notice to downstream chains, did not flag the release as security-critical, and did not notify affected chains that a public release had occurred until August 21 at 03:36 UTC — two full days after the code was visible to anyone reading the commit history.
Meanwhile, a public pull request describing the vulnerability and exploitation path appeared on August 20 at 07:16 UTC, created through an unrelated project's fork. MANTRA's first unauthorized transaction occurred at 19:06 UTC on the same day, roughly 12 hours later.
The security community responded with sharp criticism. According to reporting by Protos, the approach was described as "negligent" by multiple security researchers. KiiChain's post-mortem stated explicitly that publishing the fix before giving chains time to patch "hands the vulnerability to anyone reading the commit."
Six blockchain networks were exploited between August 20 and August 25. The confirmed total: approximately $5.72 million. Of that, $2.87 million was converted through decentralized exchanges and $2.85 million through centralized venues, where accounts have since been frozen.
Cosmos Labs' post-mortem confirmed six networks were exploited in total. The identities of the fifth and sixth chains have not been publicly disclosed as of August 29.
The Cosmos EVM module is a shared open-source dependency maintained by Cosmos Labs. It is the component that allows any Cosmos SDK-based blockchain to execute Ethereum-compatible smart contracts. Dozens of chains run it. When a defect exists in this module, every chain inherits the exposure.
This is a supply-chain problem analogous to traditional software dependencies like Log4j or OpenSSL, but with a critical difference: in blockchain infrastructure, exploits are immediately monetizable. There is no patching window. There is no grace period. The moment a vulnerability is public, capital is at risk.
The August incident underscores three structural weaknesses:
1. Centralized maintenance, decentralized deployment. One organization maintains the code. Dozens of independent teams deploy it. Communication channels between the maintainer and downstream operators were inadequate. Cosmos Labs contacted 40 networks after exploitation began and discovered 11 previously unknown Cosmos EVM deployments outside its existing security-communication channels.
2. Absent coordination infrastructure. There was no standardized process for distributing security-critical patches to all downstream chains before public release. The Cosmos ecosystem, valued at over $7 billion by market capitalization, relies on ad hoc email communication for critical security disclosures.
3. State-breaking patches. The fix was state-breaking, requiring coordinated validator upgrades. This made silent patching impractical and fast deployment impossible — a design constraint that should have triggered immediate private disclosure, not a public release.
As of August 29, 2026:
Cosmos Labs stated it would revise its vulnerability triage and disclosure procedures following the incident.
This was not the first time a Cosmos EVM defect caused material losses. In January 2026, the SagaEVM network lost approximately $7 million when an attacker exploited a related vulnerability (ASA-2026-001) involving incorrect state handling during nested EVM execution paths. The attacker used forged Inter-Blockchain Communication messages to mint uncollateralized stablecoins, then bridged the proceeds to Ethereum.
That earlier incident affected 15 chains running the vulnerable code, though only one was exploited. SagaEVM's total value locked dropped 55% within 24 hours, and the patch was released as v0.6.0 in March 2026.
Combined, the January and August incidents represent over $12 million in losses from two defects in the same shared module within eight months. The August exploit involved three bugs that were distinct from but architecturally adjacent to the January flaw.
The Cosmos EVM incident is not primarily a story about a software bug. Unsigned-integer underflows are a known class of vulnerability. The defect was reported, acknowledged, and even partially patched — four months before it was exploited.
The failure was organizational. A bug bounty report was triaged incorrectly. A fix was published publicly without downstream notification. The resulting exploitation window cost six networks $5.72 million and forced multiple chains offline for days.
For the Cosmos ecosystem, the immediate question is procedural: how to distribute security-critical patches across a fragmented network of independent operators, including the ones the maintainer does not know about. The 11 unknown deployments discovered during the incident response represent a systemic blind spot.
For the broader blockchain industry, the lesson is structural. Shared dependencies are efficient until they fail. When they do, the blast radius scales with adoption. The Cosmos EVM module is used by dozens of chains across a $7 billion ecosystem. Its security posture — a single-entity maintenance model with ad hoc email-based disclosure — does not match the scale of the infrastructure it underpins.