A Quiet Patch, Then a String of Drained Chains
Cosmos Labs has confirmed that a critical balance-handling flaw in its shared Cosmos EVM module, designated GHSA-7g4w-cg88-2cq2, was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability was published without a CVE identifier, a weakness classification, or a CVSS score, an unusual omission for a flaw the company itself rates critical. Affected versions run below 0.6.2 and within the 0.7.x line below 0.7.2, with fixes shipping in both 0.6.2 and 0.7.2 on August 19, a state-breaking change that requires chain operators to coordinate a network upgrade rather than apply a simple software update.
In a post-mortem published August 28, Cosmos Labs disclosed that the flaw had actually been reported through its bug bounty program back on April 25, and was assessed at the time as posing no risk to funds on live networks. "We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks," the company said. That initial misjudgment sat unresolved for months before the team's understanding of the bug's true scope caught up with reality, by which point the fix had already been drafted and merged into the public codebase.
The Bug Itself: Vesting Accounts and an Unchecked Subtraction
The flaw lives in the code that reconciles Ethereum Virtual Machine state with the Cosmos SDK's bank module. The EVM's StateDB tracks only an account's spendable balance, while vesting accounts in the underlying SDK state carry both a spendable balance and a separate locked balance, and both the staking module and its precompile allow the locked portion to be delegated. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure without a bounds check, wrapping the balance to roughly 2 to the 256th power.
From there, reconciliation mints tokens on a positive delta and burns them on a negative one, letting an attacker move a finite amount out of the wrapped account or send a victim account an amount calculated to burn the victim's real holdings instead. Both halves execute inside a single transaction with a net supply change of zero, launched from a contract deployed to a precomputed address that was first converted into a vesting account. Exploitation requires only that a chain permit permissionless creation of vesting accounts, a default configuration on many Cosmos EVM deployments.
A Policy That Says One Thing, and a Process That Did Another
Cosmos Labs' own published silent patch policy sets a clear bar for flaws of this severity: "When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs." The company confirmed internally by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration, a network-wide risk finding by its own definition. Instead of triggering the private distribution process its policy describes, the team routed the fix through the same silent patch process reserved for issues that do not threaten fund loss on production networks.
The company's own explanation acknowledges the mismatch directly: "Because the patch had already been publicly available on the main branch without known exploitation, the team concluded that it would be safe to proceed with the silent patch process." That reasoning treated the absence of observed exploitation as equivalent to the absence of risk, even after confirming the bug threatened every live deployment of the software. Cosmos Labs disclosed that it has released patches for 37 vulnerabilities silently over the prior 13 months without downstream developers precisely describing exploit paths in public, suggesting this approach was standard practice rather than a one-time lapse in judgment.
From Silent Fix to Public Exploit Path in Eight Hours
The gap between quiet patch and active exploitation was almost immediate. A public pull request in Push Chain's fork of Cosmos EVM described the vulnerability and its exploitation path in detail at 07:16 UTC on August 20, roughly eight hours and fifteen minutes after the patched releases went out. The first confirmed attack, against the MANTRA chain, began eleven hours and fifty minutes after that pull request appeared, at 19:06 UTC. Cosmos Labs sent its first private notification to affected chains by secure email at 03:36 UTC on August 21, about two hours after MANTRA had already reported it was under active exploitation.
Both the v0.6.2 and v0.7.2 release notes state that the release contains important security fixes that should be applied as soon as possible, but both omit the specific security backport from their changelogs, leaving downstream developers to infer urgency from vague wording rather than a clear description of what was actually being fixed. The Hacker News confirmed on August 29 that neither release lists the pull requests carrying the fix, the same opacity that let the silent patch sit unnoticed by most operators until attackers, rather than the vendor, made its significance clear.
Uneven Fixes Across the Ecosystem, and the Bill So Far
Downstream response to the disclosure has been inconsistent. ZetaChain contributor morde08 published a port of all three related fixes on August 21, noting that a naive cherry-pick of the patch left the fork's live code path unpatched, because the fork carried duplicated unexported helper functions while the upstream fix touched only the exported version. Warden Protocol took a different route two days later, blocking vesting-account creation outright. Contributor jlehtimaki explained the choice in a commit message: "Vesting accounts are the only source of locked balances on Warden and nothing depends on users being able to create them, so removing that path closes the precondition rather than relying on the reconstruction being correct."
Cosmos Labs said it is aware of six chains where the exploit was actually leveraged, and that attackers sold approximately 2.87 million dollars in affected assets on decentralized exchanges based on August 19 prices, a figure the company says came from the affected chains themselves and has not been independently audited. A further 2.85 million dollars was sold on centralized exchanges, estimated from public volume data. With the Cosmos ecosystem spanning more than 115 known public blockchains and no complete registry of who runs its software, Cosmos Labs also learned of eleven Cosmos EVM deployments during the incident that had never registered with its security channels at all.
