Cosmos EVM: Bug Known Since April, $5.7M Exploit Across Six…

Cosmos Labs identified the critical vulnerability in the EVM module in April 2026. The decision to proceed with a public silent patch left a 20-hour window for attackers before the first exploit hit MANTRA's burn address. By August 25, six chains had suffered losses of approximately $5.72 million.

Cosmos Labs knew as of August 13, 2026, that every blockchain built on the Cosmos EVM module was vulnerable to a balance-handling flaw. It proceeded with a public silent patch anyway, judging the process safe because the fix was already on the main branch with no known exploits. Twenty hours later, the first attack drained MANTRA's burn address. By August 25, six chains had sustained losses of approximately $5.72 million.

Key Takeaways

The flaw GHSA-7g4w-cg88-2cq2, classified as Critical by Cosmos Labs, was reported on April 25, 2026, but initially assessed as non-dangerous for 18-decimal networks
The patch was released publicly on August 19 in v0.6.2 and v0.7.2, without the emergency private fix distribution required by Cosmos Labs' own internal policy
First public description of the exploit path in a Push Chain fork at 07:16 UTC on August 20; first attack against MANTRA at 19:06 UTC the same day
Cosmos Labs sent its first private notification at 03:36 UTC on August 21, roughly two hours after MANTRA had already reported the ongoing exploit

The Mechanism: Unchecked Underflow Between StateDB and x/bank

The vulnerability lies in the reconciliation of balances between the EVM StateDB, which tracks only the spendable balance, and the Cosmos SDK x/bank module, which manages spendable balances plus locked balances. When a vesting account delegates an amount exceeding the spendable balance, the unchecked subtraction generates an underflow that wraps to ~2^256, infinitely manipulating mint and burn functions.

Exploitation requires three cumulative conditions: permissionless creation of vesting accounts, a delegation path via the staking precompile or equivalent, and the presence of the flawed SubBalance function version. Affected versions are those prior to 0.6.2 and from 0.7.0 to 0.7.2 exclusive, as documented by The Hacker News.

The fix requires a coordinated state-breaking upgrade, not a simple code swap. Disabling the staking precompile or blocking vesting account creation are partial mitigations, not solutions: Warden Protocol contributor jlehtimaki observed that removing the vesting account creation path closes the prerequisite rather than relying on the correctness of balance reconstruction.

Timeline: From Bounty Report to Exploit in 117 Days

The flaw was reported through Cosmos Labs' bug bounty program on April 25, 2026. The team initially failed to reproduce the vulnerability on 18-decimal networks and incorrectly concluded it affected only non-18-decimal configurations, as admitted in the Cosmos Labs post-mortem: "We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks."

By August 13, Cosmos Labs confirmed that all Cosmos EVM chains were affected regardless of decimal configuration. Despite its own bug bounty policy — last updated July 27 — which mandates "emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs" for matters presenting "immediate or network-wide risk," the team opted for the public silent patch process.

The rationale, per the post-mortem: "Because the patch had already been publicly available on the main branch without known exploitation, the team concluded that it would be safe to proceed with the silent patch process." The v0.6.2 and v0.7.2 release shipped on August 19 at 19:01 ET. At 03:16 ET on August 20 — 07:16 UTC — a Push Chain developer committed a code change publicly describing the vulnerability and exploit path. At 15:06 ET — 19:06 UTC — the first attack against MANTRA began.

"Twenty hours was not a realistic window in which to assess, build, test and coordinate a state-breaking upgrade across 38 independent validators, particularly without a vulnerability-specific advisory"

The Damage: Six Chains, $5.72 Million Realized

Cosmos Labs confirmed six exploited blockchains between August 20 and 25, 2026, with realized proceeds estimated at approximately $5.72 million at August 19 prices: roughly $2.87 million on decentralized exchanges and roughly $2.85 million on centralized exchanges. The figure has not been independently verified, as specified by the source itself.

MANTRA lost 720.9 million MANTRA tokens, valued at approximately $3.6 million, drained from the burn address and a dormant multisig. TAC lost nearly 3 billion TAC tokens from the staking pool, of which about 1.2 billion were sold on BNB Chain for approximately $950,000. KiiChain lost approximately 148 million KII tokens, with 64.6 million sold for approximately $1.6 million.

Three additional chains were attacked but not named by Cosmos Labs. Nesa was indicated as a possible target based on exchange deposit suspensions and Bubblemaps analysis, without official confirmation. MANTRA, per its August 28 statement, had not recovered funds.

Governance Collapse: When Process Becomes the Vulnerability

The incident is not technically an oversight of the flaw, but a process choice. Cosmos Labs had classified the bug as Critical, confirmed universal impact, and possessed policy mandating private distribution for immediate network-wide risks — yet proceeded with a public silent patch.

The KiiChain post-mortem, cited by The Block, charges: "Cosmos Labs gave no advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains that a public release had happened until Friday 21 August, two days later." KiiChain adds that "a patch takes days to review, build, test and roll out across a validator set. A halt takes minutes. The only measure that would have contained the risk immediately was a clear instruction to stop producing blocks, and that instruction came after the damage was done."

The disclosure system revealed a structural blind spot: during the incident, Cosmos Labs discovered 11 Cosmos EVM deployments that had never registered security contacts. Across roughly 115 public blockchains in the Cosmos ecosystem, downstream visibility is insufficient for coordinated disclosure processes. This is compounded by a technical maintenance issue: ZetaChain contributor morde08 noted that cherry-picked patches in forks left the live path unresolved due to duplicated unexported helpers.

Immediate Actions

Immediately verify the Cosmos EVM module version in production: upgrade to v0.6.2 or v0.7.2 if running an affected version
Check for duplicated unexported helpers in any code forks, which may leave the vulnerable path active despite the patch
Register security contacts with Cosmos Labs if your deployment has not yet done so, given that 11 chains were discovered without registration during the incident

Why This Case Changes the Rules of Distributed Open-Source Security

The lesson is not that patches must be secret, but that the security of widely distributed open-source infrastructure cannot rely on the assumption that downstream recipients will independently recognize the significance of a commit. Cosmos Labs treated public patch availability as equivalent to conscious distribution, ignoring that 38 independent validators on a single chain — let alone five others — do not constitute a single operator with a unified monitoring system.

For investors and users, the incident exposes a previously opaque dependency risk: token holdings on apparently sovereign chains can be exposed to vulnerabilities in shared modules whose branding does not reveal the technical relationship. For blockchain projects, the question is whether disclosure processes designed for single-vendor software are adaptable to ecosystems where the "vendor" is a component provider with no visibility into who employs its code.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter