Cosmos Labs has acknowledged mistakenly underestimating the severity of a vulnerability in the Cosmos EVM module. This oversight led to attacks on six blockchains, resulting in total damages of $5.7 million.
Between August 20th and August 25th, attackers exploited a vulnerability in Cosmos EVM to extract funds from multiple Cosmos-based blockchains. We are committed to strengthening the systems and processes we rely on for security and are grateful for the collaboration of the…
— Cosmos Labs (@cosmoslabs_io) August 28, 2026
The issue was reported on April 25, 2026, through a bug bounty program. After testing, the team concluded that production-configured networks were not at risk and released a public fix without a specific warning to operators. In early August, independent researchers demonstrated that the vulnerability affected all networks on Cosmos EVM. Developers then masked the patch, included it in releases v0.6.2 and v0.7.2, and published them on the evening of August 19. The first known attack began approximately 20 hours later.
In a post-mortem, Cosmos Labs described the attack as a chain of underflow followed by overflow. Through a specially crafted vesting account and a malicious contract, the attacker caused incorrect balance recalculations and then transferred funds from addresses with large balances. The company asserts that no new tokens were created and the total supply remained unchanged.
The largest confirmed loss was suffered by MANTRA. According to network analysis, 720.9 million MANTRA, worth approximately $3.6 million, were withdrawn from a burn address and an old multisig wallet. The network was halted on August 20, 2026, and resumed over 30 hours later without a state rollback. MANTRA stated that no client accounts were affected, but tokens previously considered economically inactive were effectively put into circulation.
Cosmos Labs estimated TAC losses at 2.99 billion TAC, with about 1.21 billion tokens sold on BNB Chain for approximately $950,000.
KiiChain lost approximately 148.3 million KII. The company estimated that 64.6 million tokens were sold for about $1.6 million, while approximately 54.4% of the stolen tokens remained in the network and could be recovered after restoration.
Cosmos Labs did not name the other three affected networks.
MANTRA and KiiChain criticized the disclosure process. The team from the first network stated that 20 hours was insufficient to assess, compile, test, and coordinate an update among 38 validators without specific notification of the vulnerability. KiiChain noted that the recommendation to halt networks came after attacks on three blockchains had already occurred.
In response, Cosmos Labs stated that it coordinated with 40 networks and separately identified 11 unregistered Cosmos EVM deployments within an ecosystem of over 115 public blockchains.
Earlier, from January 2025 to July 2026, crypto platforms lost $3.63 billion in 245 documented incidents, according to CoinGecko data.
