Cosmos EVM Bug Drains Six Chains, Triggers Upgrades

Six Chains Hit by a Balance‑Underflow Bug

Between August 20‑25, 2026, attackers siphoned assets from six Cosmos‑based blockchains by abusing a balance‑handling flaw in the shared Cosmos EVM module.

The vulnerability, catalogued as GHSA‑7g4w‑cg88‑2cq2, was rated Critical by Cosmos Labs but never received a CVE number, weakness classification, or CVSS score.

Why the flaw mattered

The bug lives in the code that reconciles EVM state with the Cosmos SDK x/bank module. An unchecked subtraction lets a balance wrap around to ~2^256, effectively granting the attacker the ability to mint or burn tokens at will.

Exploitation hinges on a chain allowing permissionless creation of vesting accounts – a feature many Cosmos EVM deployments expose by default.

Technical timeline

April 25 – bug reported via Cosmos Labs’ bounty program; initially deemed harmless.
May 15 – sub‑balance underflow guard merged (PR #1176); back‑ported on August 13.
May 20 – snapshot lock PR #1187 merged; back‑ports opened same day, merged within 24 hours.
August 13 – Cosmos Labs confirms all Cosmos EVM chains are vulnerable, regardless of decimal configuration.
August 19 – patches released in v0.6.2 and v0.7.2 (state‑breaking, requires coordinated upgrade).
August 20, 19:06 UTC – first attack observed on the MANTRA chain.
August 21, 03:36 UTC – Cosmos Labs sends private notification to affected operators.
August 20, 07:16 UTC – public pull request on Push Chain’s fork describes the flaw, eight hours after the patches went out.

Who was affected

Any Cosmos EVM deployment running versions <0.6.2 or >=0.7.0 <0.7.2 was at risk. The six exploited chains include MANTRA, ZetaChain, Warden Protocol, Push Chain, and two others not named publicly.

The Cosmos ecosystem hosts over 115 public blockchains, but Cosmos Labs does not maintain a definitive registry of which networks run the vulnerable code.

Defensive steps

Cosmos Labs’ advisory boiled down to a short, hard‑line checklist:

Upgrade immediately to v0.6.2 or v0.7.2. The change is state‑breaking, so coordinate a network upgrade.
If you cannot upgrade, halt block production rather than attempt a piecemeal governance upgrade.
Reject any MsgCreateVestingAccount (or equivalent) messages until the patch is live.
Verify that the live code path includes the two additional fixes (PR #1176 and PR #1187 back‑ports) and that commit 3524ebc blocks balance setting on module accounts.
Register a security contact with Cosmos Labs to receive future silent‑patch notifications.

Policy implications

Cosmos Labs normally distributes emergency fixes via private channels, emergency mitigations, or coordinated upgrades before public disclosure. In this case they chose a public silent‑patch route, publishing the patches without mentioning the specific pull requests in the release notes.

Over the past 13 months the team silently patched 37 vulnerabilities, a practice that leaves downstream developers guessing about the exact attack surface.

“The fix shipped on August 19, but the exploit started the very next day,” a Cosmos Labs spokesperson said, highlighting the razor‑thin window between patch release and real‑world abuse.