Cosmos EVM Flaw Drained Funds From Six Chains After Silent Patch Failure

Cosmos Labs has disclosed that a critical balance-handling vulnerability in the shared Cosmos EVM module, tracked as GHSA-7g4w-cg88-2cq2, was actively exploited between August 20 and August 25, 2026, draining funds from at least six Cosmos-based blockchains. Affected versions include releases earlier than 0.6.2 and those between 0.7.0 and 0.7.1; the patch shipped in v0.6.2 and v0.7.2 on August 19. Because the fix is state-breaking, Cosmos Labs is requiring a coordinated network upgrade, and operators unable to upgrade immediately have been instructed to halt their chains rather than attempt governance-led migrations.

The vulnerability sits in the reconciliation layer between the EVM StateDB and the Cosmos SDK x/bank module. The EVM tracks only spendable balances, while vesting accounts maintain separate spendable and locked figures that can both be delegated via x/staking and the staking precompile. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable value without underflow protection, wrapping the balance to roughly 2^256. Subsequent reconciliation mints on positive deltas and burns on negative ones, allowing an attacker to siphon finite amounts from wrapped accounts or to flood a victim with 2^256 minus their balance to trigger destructive burns.

According to an August 28 post-mortem, the flaw was reported through Cosmos Labs' bug bounty program on April 25 and initially dismissed as low-risk because the team could not reproduce it on 18-decimal networks. By August 13, engineers confirmed the bug affected every Cosmos EVM chain regardless of decimal configuration, yet the fix was still routed through the company's public silent patch workflow. That process is intended for non-critical issues on production chains, while Cosmos Labs' own policy states that vulnerabilities posing immediate or network-wide risk should receive private patch distribution and coordinated upgrades before any public disclosure. The mismatch between policy and practice is now the subject of broader scrutiny, and blockchain operators are urged to audit their node infrastructure, including exposed RPC endpoints, using tools like our port scanner to confirm no lingering attack surface remains after patching.

Chain operators running affected versions should upgrade to v0.6.2 or v0.7.2 immediately, verify consensus state across validator nodes, and review transaction logs from the August 20-25 window for anomalous balance reconciliations or unauthorized delegations from vesting accounts. Independent security teams are also advising broader hygiene checks on adjacent Web3 infrastructure, including SSL/TLS certificate validation on validator and RPC endpoints and DNS leak testing on operator workstations to prevent lateral compromise. With a formal CVE still absent and no CVSS score published, Cosmos Labs has been pressed to align its silent patch policy with its bug bounty disclosure language before the next critical flaw surfaces.