Cosmos Labs' EVM Flaw Sparks $5.7M Multi‑Chain Heist

The breach that rattled the Cosmos ecosystem

Between August 20 and August 25, 2026, a single vulnerability in the Cosmos EVM (Ethereum Virtual Machine) module was weaponized to drain a total of $5.72 million from six distinct blockchains that rely on the shared runtime. Cosmos Labs, the steward of the module, confirmed that the flaw—catalogued internally as GHSA-7g4w-cg88-2cq2—was known to be critical but had never been assigned a public CVE, weakness classification, or CVSS score.

What the flaw actually did

The EVM module is a shared library that enables Cosmos‑based chains to execute Ethereum‑compatible smart contracts. The bug resides in the balance‑handling routine that updates an account’s token total after a transfer. Under certain conditions—specifically when a contract attempts to credit an account with a value that overflows the internal 256‑bit integer—the routine fails to enforce the proper under‑flow check, allowing an attacker to artificially inflate the recipient’s balance.

Timeline of the exploit

Cosmos Labs released a terse statement on August 26, 2026, confirming the breach. Independent security researchers corroborated the timeline:

Technical deep‑dive: why the bug mattered

The EVM module’s balance routine is a low‑level function called by virtually every token transfer, NFT mint, and DeFi interaction on a Cosmos‑based chain. By targeting the arithmetic overflow path, the attacker avoided the typical gas‑limit or re‑entrancy defenses that protect higher‑level contract logic. Because the flaw exists in the shared runtime, any chain that had not yet upgraded past version 0.6.2 was exposed.

• Version scope: All deployments running < 0.6.2 and any that inadvertently rolled forward to a malformed >= 0.6.2 build without the corrective patch were vulnerable.
• Missing public identifiers: Cosmos Labs chose not to publish a CVE or CVSS score, limiting the broader security community’s ability to prioritize remediation.
• Attack vector: The exploit required only a single crafted transaction; no private key compromise was needed.

Impact on the Cosmos ecosystem

Six blockchains—ranging from DeFi hubs to NFT marketplaces—suffered immediate liquidity loss, prompting a wave of token freezes and user withdrawals. The incident has reignited debate over the trade‑off between rapid ecosystem growth and rigorous, publicly disclosed security auditing. Developers now face pressure to adopt the newly released 0.6.3 patch, which introduces explicit overflow checks and emits detailed event logs for balance updates.

Cosmos Labs’ response and community remediation

On August 27, Cosmos Labs issued a patch bundle labeled v0.6.3‑security and opened a public GitHub issue inviting auditors to verify the fix. The organization also announced a retroactive bounty of $250,000 for anyone who can produce a reproducible proof‑of‑concept for the original flaw—though the initial bounty had reportedly been missed, as noted by Coin Gabbar.

Chain operators that migrated to the patched runtime within 48 hours reported no further anomalous activity. However, the incident underscores the systemic risk of shared runtime components in a multi‑chain environment.

Broader lessons for modular blockchain architectures

The Cosmos EVM episode illustrates three hard‑won lessons:

1. Transparency matters: Public CVE assignment and CVSS scoring enable coordinated defense across independent chains.
2. Version hygiene is non‑negotiable: Automatic upgrade pathways must enforce minimum security thresholds, especially for shared libraries.
3. Community‑driven auditing: Open‑source modules benefit from continuous third‑party review; withholding critical details can delay detection.