Cosmos EVM Flaw Drained $5.72M Across Six Chains, Post-Mortem Says

Cosmos EVM Flaw Drained About $5.72M Across Six Chains

The loss-impact check has two parts that should not be conflated. Cosmos Labs said approximately $2.87 million in affected assets was bridged from the chains and sold on DEXs, and it estimated another $2.85 million was deposited and sold on centralized exchanges. Together, the figures imply approximately $5.72 million in reported attacker proceeds as of the Aug. 28 post-mortem.

The DEX amount was based on publicly available on-chain data, the company said. Its listed assets included 2,613,674.48 USDT, 114.129045 ETH, 93.78 TON, 1.393618 USDC and 98.87 OSMO, which attackers moved through bridges before exchanging them for stablecoins and other assets, including wrapped ether.

The centralized-exchange figure is less direct. Cosmos Labs said it was estimated from publicly available volume data and that affected chains reported the related accounts were frozen pending police investigation. It did not name the exchanges, attacker identities, six affected networks, wallet addresses, a recovered amount or a timetable for returning assets.

Those qualifications are important for anyone reading the headline total as a final loss accounting. The post-mortem calls the chain-provided figures consistent with available estimates, but not independently audited. A frozen account can preserve evidence and potentially restrain further sales, yet it does not establish that assets will be recovered or identify who ultimately bore the losses.

The incident resembles the shared-infrastructure risk described in our report on an Aptos VM flaw, where a defect in a common execution layer created exposure beyond a single app. The Cosmos event is different because Cosmos Labs now reports confirmed exploitation and movement of assets, not a researcher simulation.

Cosmos Labs Says Cosmos EVM Patch Requires Coordinated Upgrade

The technical failure sat in the balance reconciliation between Cosmos EVM’s StateDB and the Cosmos SDK’s x/bank module. Cosmos Labs said the EVM balance view tracks a vesting account’s spendable balance, while the staking path can delegate locked balances too. Delegating more than the spendable balance could therefore create an unchecked underflow, making the balance wrap to a huge number.

Attackers combined that underflow with an overflow of a high-balance target account in one transaction, the report said. The result could move a real balance to the attacker while leaving the total token supply unchanged, rather than simply producing a visible unsupported mint. On affected older releases, the overflow could halt a chain; newer releases could accept balance changes that survived a numerical conversion.

The official advisory lists releases below v0.6.2 and v0.7.0 through v0.7.1 as affected. Its patches, v0.6.2 and v0.7.2, add an underflow guard but require a state-breaking, coordinated network upgrade.

There is no configuration-only fix, the advisory says. Operators that cannot upgrade immediately are told to halt rather than attempt a coordinated governance upgrade without the patch, while disabling the staking precompile is described only as a partial reduction of the trigger path. That means wallet users should look for a chain’s own upgrade, restart and service notices rather than assume a published release immediately restores transfers, bridges or exchange deposits.

Cosmos EVM is a reusable framework that adds Ethereum compatibility to Cosmos SDK chains. Its official repository lists integrations including MANTRA, TAC and other networks, but it does not itself identify the six exploited chains in the post-mortem. The distinction matters because use of Cosmos EVM alone does not establish that a particular network was exploited.

MANTRA Report Became a Wider Cosmos Security Incident

Cosmos Labs said the original bug bounty report arrived on April 25 with a proof of concept for a six-decimal network. The team said it could not reproduce the effect on 18-decimal configurations and wrongly concluded that live production networks were not at risk, leading it to use a public silent-patch process rather than its private emergency process.

In early August, it said, new researcher information showed every Cosmos EVM chain was affected regardless of decimal configuration. The company nevertheless used its silent-patch process because the core fix had already been public on the main branch. A public downstream pull request later described the exploit path before the first known incident, according to the post-mortem.

The sequence leaves a concrete governance question alongside the code fix: whether widely reused blockchain components can identify when a technical defect needs coordinated private response before the path becomes easy to reproduce. Cosmos Labs said it will revise its vulnerability triage, strengthen coordinated-disclosure channels and commission a broader external review of its security practices.

The most immediate next steps are chain-specific. Operators need to confirm their version, complete a coordinated upgrade or halt; affected users need independent notices on deposits, withdrawals and bridges; and investigators need to establish whether frozen exchange balances can be recovered. This is distinct from the recent Moonwell Base lending incident, but both cases show that pausing a service can be a containment measure rather than a final loss or recovery verdict.

Broader crypto sentiment remained in Greed territory despite the protocol-specific security news. Alternative.me’s Crypto Fear and Greed Index read 68 on Aug. 29, down from 73 the prior day.

Cosmos Labs’ post-mortem supplies the first ecosystem-wide loss estimate and a clear software-action threshold, but not a final recovery account. The facts to watch next are the six networks’ individual disclosures, proof of completed upgrades, any expansion of the affected-chain count and the outcome of the exchange-account investigations.