Cosmos Labs has confirmed that a serious vulnerability in its shared Cosmos EVM module was actively exploited between August 20 and August 25, 2026, leading to drained funds across six separate blockchains. The issue, known as GHSA-7g4w-cg88-2cq2, was disclosed on its system despite lacking a CVE identifier, vulnerability classification, or base CVSS score. Operators of vulnerable versions—below 0.6.2 or between 0.7.0 and before 0.7.2—were urged to upgrade on August 19th, through coordinated, state-breaking network upgrades.
How the breach unfolded
The bug emerged due to an error in balance reconciliation between the EVM’s StateDB and the Cosmos SDK’s x/bank module. In lay terms, vesting accounts—which are meant to have locked and spendable balances—were able to delegate more than their spendable balance. This over-delegation triggered an unchecked subtraction underflow that wrapped the spendable balance to near the maximum uint256 value. Attackers leveraged this to either transfer value from the wrapped account, or force another account’s balance into burning mode, wiping out real funds.
Chains running version 0.6.x are particularly affected: a large mint triggers a supply overflow that halts the chain. Versions 0.7.x behave differently—accepting changes surviving uint256 to int256 conversion, creating other havoc. Exploits rely on permissionless creation of vesting accounts, which many chains allow by default. The fix released in v0.6.2 and v0.7.2 addressed these problems but required major state changes, prompting calls for a coordinated upgrade.
Timeline and missed signals
Cosmos Labs first received a report of the vulnerability via its bug bounty program on April 25. At that time it was judged not to risk live networks, because the issue couldn’t be reproduced on chains using the standard 18 decimal token format. By August 13, that view had shifted—labs confirmed that all Cosmos EVM chains were vulnerable regardless of decimals. Even so, the team deployed the fixes using their “silent patch” process, meant for non-production-impact bugs, rather than alerting operators privately or coordinating emergency mitigations.
The first exploit was observed on the MANTRA chain, beginning around 19:06 UTC on August 20, roughly 12 hours after functioning patches were live. Notification to Cosmos Labs from MANTRA followed early on August 21 via secure email. By August 28, operators had identified at least six chains which had been compromised.
Impact and response
Financially, attackers offloaded about USD 2.87 million worth of affected assets on decentralized exchanges, based on August 19 prices. Another USD 2.85 million was estimated to have been sold on centralized exchanges, per public volume data. Cosmos Labs reported that it does not have a full registry of public chains using its EVM software—an issue that delayed coordinated responses.
Remediation steps include upgrading to versions 0.6.2 or 0.7.2 or later via coordinated state-breaking upgrades, halting chains unable to upgrade immediately, disabling or rejecting vesting-account creation messages, and auditing live code paths to ensure no leftover vulnerable code remains via unexported helpers. Operators were also urged to establish timely security contacts with Cosmos Labs, especially as eleven deployments during the incident had no security channels registered.
This was not Cosmos Labs’ first case of “silent patch” usage—over the previous 13 months it quietly released fixes for 37 vulnerabilities without public exploit-path disclosure. Both release notes for v0.6.2 and v0.7.2 mentioned “security fixes” and urged swift application, but notably omitted specific pull request backports in their changelogs.
The Cosmos ecosystem comprises over 115 public blockchains, but without a central inventory of who’s running vulnerable versions, many nodes were caught off guard. The bug exposed gaps in coordination, communication, and assumptions about risk—especially when initial tests showed no danger for specific configurations, leading to dangerous delays.
What to watch: whether Cosmos Labs updates its silent patch and disclosure policies, how many more chains reveal compromise, and the community’s response to embedding better inventory and emergency channels in open source blockchain ecosystems.
