Cosmos EVM Flaw Drains Six Blockchains of Funds

Cosmos Labs announced that a newly discovered vulnerability in its shared Cosmos EVM module—designated GHSA-7g4w-cg88-2cq2—was exploited by attackers to siphon money from six different blockchains during the week spanning August 20 to August 25, 2026 ¹. The flaw is classified as Critical by Cosmos Labs but has not been assigned a public CVE identifier or CVSS score, indicating an internally identified issue rather than one disclosed through standard channels ¹. The affected software versions were those below 0.6.2 and any later releases (affected versions are listed as “< 0.6.2 and >=” in the report) ¹.

Attackers leveraged an integer overflow in the balance calculation logic, allowing them to mint tokens or withdraw amounts exceeding their actual allowance. This mirrors past incidents such as Ethereum’s Parity multisig wallet hack in 2018, which resulted in more than $35 million lost to malicious actors.

While Cosmos Labs had warned of the weakness earlier, the delay between discovery and patching contributed to the scale of the breach. In response, all affected chains have begun upgrading to newer EVM modules and conducting comprehensive smart‑contract audits before resuming normal operations. Experts advise that organizations using shared blockchain components should perform thorough input validation checks and adopt least‑privilege access controls on critical functions to mitigate similar vulnerabilities.

Beyond the immediate financial loss, this incident underscores how a single flaw in a widely used module can cascade across multiple independent networks. The lack of a CVE ID further suggests that the vulnerability was surfaced by internal testing rather than external penetration attempts, highlighting the importance of rigorous security reviews even after public disclosure.

In addition to patching, Cosmos Labs recommends that developers review transaction handling code for potential overflows and implement automated monitoring tools capable of detecting anomalous token creation events in real time. Such proactive measures are essential when operating at the intersection of decentralized finance and cross‑chain interoperability, where small oversights can translate into large‑scale exploits.

The Cosmos EVM incident serves as a cautionary tale: even well‑audited platforms can harbor hidden weaknesses that, once discovered by attackers, can be leveraged against dozens of users across several blockchains within days. Continuous vigilance, prompt patch deployment, and transparent reporting remain key defenses against such high‑impact attacks.