A critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026, Cosmos Labs warned in a post-mortem published August 28. Attackers sold roughly $2.87 million in affected assets on decentralized exchanges and a further $2.85 million on centralized platforms, according to estimates from the affected chains and public volume data. The vulnerability, designated GHSA-7g4w-cg88-2cq2 and rated Critical, affected versions below 0.6.2 and versions 0.7.0 through 0.7.1, with patches released August 19 in v0.6.2 and v0.7.2.
The flaw was reported through Cosmos Labs' bug bounty program on April 25 and initially assessed as posing no risk to funds on live networks. "We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks," Cosmos Labs said in the post-mortem. By August 13, the team confirmed that all Cosmos EVM chains were affected regardless of decimal configuration. The fix was then routed through the company's public silent patch process, which it reserves for issues that don't cause fund loss on production chains. The first attack against MANTRA began at 19:06 UTC on August 20, eleven hours and fifty minutes after a public pull request in Push Chain's fork of Cosmos EVM described the vulnerability and its exploitation path in detail at 07:16 UTC. Cosmos Labs sent its first private notification by secure email at 03:36 UTC on August 21, roughly two hours after MANTRA reported it had been exploited.
The vulnerability sits in code that reconciles Ethereum Virtual Machine state with the Cosmos SDK x/bank module, according to the advisory. The EVM StateDB tracks only an account's spendable balance, while vesting accounts in SDK state hold both spendable and locked balances, and both x/staking and the staking precompile allow the locked portion to be delegated. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction isn't checked, and the balance wraps to roughly 2^256. Reconciliation then mints on a positive delta and burns on a negative one. The attacker can move a finite amount out of the wrapped account, or send a victim account 2^256 minus its balance so that reconciliation burns the victim's real holdings. Both halves run inside a single transaction with a net supply change of zero, from a contract deployed onto a precomputed address that was first turned into a vesting account. Exploitation requires the chain to permit permissionless vesting-account creation.
Chain operators running Cosmos EVM are advised to upgrade to v0.6.2 or v0.7.2 or later, applying it as a coordinated network upgrade because the change is state-breaking. Chains that can't upgrade immediately are told to halt block production rather than run a coordinated governance upgrade. The advisory states there's no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but isn't a substitute for the patch. Operators should also reject MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount in the ante handler to close the precondition. Cosmos Labs said it learned of eleven Cosmos EVM deployments during the incident that had never registered with its security channels. The Cosmos ecosystem spans over 115 known public blockchains, and the company holds no complete registry of the networks running its software. The gap between public disclosure of the exploit path and the first successful attack underscores how silent patching strategies can backfire when coordination fails across decentralized networks. Organizations running shared open-source infrastructure now face the choice between transparency that invites immediate exploitation and opacity that leaves downstream operators unprepared.