Cosmos EVM balance flaw exploited across six blockchain networks
Cosmos Labs said a critical flaw in its shared Cosmos EVM module was exploited to drain funds from six blockchain networks between August 20 and August 25, 2026. Attackers sold an estimated $2.87 million in affected assets on decentralised exchanges and a further $2.85 million through centralised exchanges, although Cosmos Labs said the figures had not been independently audited.
The advisory, GHSA-7g4w-cg88-2cq2, affects Cosmos EVM versions below 0.6.2 and versions from 0.7.0 up to, but not including, 0.7.2. Cosmos Labs released fixes in v0.6.2 and v0.7.2 on August 19. The company rates the issue Critical, but the advisory has no CVE identifier, weakness classification or CVSS score.
Balance reconciliation created the exploit path
The flaw lies in the reconciliation of Ethereum Virtual Machine state with the Cosmos SDK x/bank module. EVM StateDB records an account's spendable balance, whereas SDK vesting accounts also retain a locked balance. The staking module and staking precompile can delegate that locked portion.
When a vesting account delegates more than its spendable balance, the subsequent write-back subtracts the delegated total from the smaller spendable amount without an underflow check. The value can wrap to roughly 2^256. Reconciliation can then mint for a positive delta or burn for a negative delta, enabling an attacker to move a finite value from a wrapped account or cause a victim's real balance to be burned.
On the 0.6.x line, minting and burning occur on the backing SDK ledger, where a sufficiently large mint can overflow supply and halt a chain. Version 0.7.x writes balances directly to x/bank and accepts changes that survive conversion from uint256 to int256. Cosmos Labs said both stages execute in one transaction with zero net supply change. Exploitation also requires permissionless creation of vesting accounts.
Public patching preceded private notifications
Cosmos Labs said the issue was reported through its bug bounty programme on April 25 and was initially judged not to endanger funds on live networks because it could not be reproduced on 18-decimal networks. By August 13, the team had established that all Cosmos EVM chains were affected regardless of decimal configuration.
Despite that conclusion, the company used its public silent-patch process, reasoning that the patch was already available on the main branch and that exploitation was not known. Its published bug bounty policy says issues posing immediate or network-wide risk should receive emergency mitigation, private fix distribution or coordinated upgrades before public disclosure. A public pull request in Push Chain's fork described the exploit at 07:16 UTC on August 20; the first attack against MANTRA began at 19:06 UTC. Cosmos Labs sent its first secure-email notification at 03:36 UTC on August 21.
Operators face a coordinated upgrade decision
Cosmos Labs directs operators to upgrade to v0.6.2, v0.7.2 or a later release through a coordinated network upgrade because the change is state-breaking. Chains unable to upgrade together should halt block production rather than pursue a coordinated governance vote. The company says there is no configuration-only mitigation, and disabling the staking precompile is not a replacement for the patch.
Operators should also reject vesting-account creation messages in the ante handler where possible, verify the effective code path on a fork, and include the separate locked-balance snapshot and module-account guard changes. Cosmos Labs learned of eleven deployments that had not registered a security contact during the incident. For businesses operating Cosmos EVM networks, the immediate implication is to maintain an accurate security contact, validate backports against the live fork, and prepare a halt procedure for state-breaking critical fixes.