Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
Attackers exploited a critical Cosmos EVM balance bug (GHSA-7g4w-cg88-2cq2) to drain funds from six blockchains; fixed in v0.6.2 and v0.7.2.
Cosmos Labs disclosed that a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2, no CVE) was exploited to drain funds from six blockchains between August 20 and 25, 2026. The bug, reported April 25 and initially judged harmless, lets vesting accounts delegate more than their spendable balance, wrapping balances to roughly 2^256 and triggering unintended mint/burn in reconciliation, potentially halting chains or burning victims' holdings. Fixes shipped in v0.6.2 and v0.7.2 on August 19 as state-breaking coordinated network upgrades; operators who cannot upgrade must halt their chains. The post-mortem notes the team used public silent patching for a fund-threatening issue, contrary to its own bug bounty policy, and that eleven deployments had never registered with its security channels.
- Affected versions: <0.6.2 and >=0.7.0 <0.7.2; no CVE, CVSS, or weakness classification assigned
- Exploitation requires permissionless vesting-account creation on the chain
- Operators told to reject vesting-account messages and add locked-balance snapshot and module-account guards
- ZetaChain contributor morde08 found cherry-picked patches left duplicate unexported helpers unpatched
- Warden Protocol blocked vesting-account creation outright as mitigation
- Vendors
- Cosmos Labs
- Products
- Cosmos EVMCosmos SDKEVM StateDB
- Organizations
- Cosmos LabsZetaChainWarden Protocol
From the original article
6 min read at thehackernews.com
Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2 , is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score. Affected versions are < 0.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.