Cosmos Labs Confirms Critical EVM Flaw Drained Funds From Six Blockchains
This digest was compiled by AI from multiple sources — links to the originals are below.
Cosmos Labs confirmed a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, was rated Critical and patched in v0.6.2 and v0.7.2 on August 19. Chain operators are told to upgrade or halt their chains.
Key Facts
- The vulnerability GHSA-7g4w-cg88-2cq2 is rated Critical by Cosmos Labs and was published without a CVE identifier, weakness classification, or CVSS score.
- Affected versions are below 0.6.2 and from 0.7.0 to below 0.7.2; the fix shipped in v0.6.2 and v0.7.2 on August 19.
- The flaw was reported through Cosmos Labs' bug bounty program on April 25 and initially assessed as posing no risk to funds on live networks.
- Cosmos Labs confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration.
- The exploit allows an attacker to wrap a balance to roughly 2^256 or burn a victim's real holdings through reconciliation.
Exploit Mechanics
The flaw sits in the code that reconciles Ethereum Virtual Machine (EVM) state with the Cosmos SDK x/bank module. The EVM StateDB tracks only an account's spendable balance, while vesting accounts in SDK state hold both a spendable and a locked balance. Both x/staking and the staking precompile permit the locked portion to be delegated. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction is unchecked, and the balance wraps to roughly 2^256; reconciliation then mints on a positive delta and burns on a negative one.
Disclosure Timeline
Cosmos Labs said the flaw was reported through its bug bounty program on April 25 and was assessed at the time as posing no risk to funds on live networks. The team confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration. The fix was routed through the same public silent patch process the company reserves for issues that do not cause fund loss on production chains. Cosmos Labs' own published silent patch policy states that when an issue presents an immediate or network-wide risk, the company will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs.
1 source
Cosmos Labs Confirms Critical EVM Flaw Drained Funds From Six Blockchains
