The record
Written from the 1 report below. Nothing here is unsourced.
- A critical flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026.
- Cosmos Labs had received a report of the flaw through its bug bounty program on April 25 but assessed it as posing no risk to funds on live networks.
- The company confirmed by August 13 that all Cosmos EVM chains were affected, then distributed the fix through a public silent patch process even though the flaw threatened user funds in production networks.
- A fix shipped in versions v0.6.2 and v0.7.2 on August 19, and chain operators are told to upgrade through a coordinated network upgrade or halt their chains if they cannot upgrade immediately.
- The incident matters because Cosmos Labs's own published security policy calls for private fix distribution in exactly this kind of situation, and the attack showed the gap between written policy and actual practice.
What to watch next
- Whether chain operators complete the state-breaking coordinated upgrade to v0.6.2 or v0.7.2, or halt chains where upgrade is not possible
- Whether the advisory names the two additional balance fixes (the locked-balance snapshot and module-account guard) that sit unlisted in the same repository
- Whether the eleven Cosmos EVM deployments found unregistered with Cosmos Labs's security channels now register contacts and apply the full set of fixes
Who said what4
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Cosmos Labs
3 quotes · 1 outlet
“We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks”
In the article
…governance upgrade. In a post-mortem published August 28, Cosmos Labs said the flaw was reported through its bug bounty program on April 25 and was assessed at the time as posing no risk to funds on live networks. " We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks ," Cosmos Labs said in the post-mortem. The team confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration. The fix was then routed through the same public silent patch process…
“Because the patch had already been publicly available on the main branch without known exploitation, the team concluded that it would be safe to proceed with the silent patch process”
In the article
…production chains. "At this point, for a vulnerability that is known to threaten user funds in production networks, the team would typically use secure channels to distribute a patch privately to the affected networks. Because the patch had already been publicly available on the main branch without known exploitation, the team concluded that it would be safe to proceed with the silent patch process ," Cosmos Labs said. The company's own published silent patch policy sets a different course for a flaw of that class. "When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency…
jlehtimaki
1 quote · 1 outlet
“Vesting accounts are the only source of locked balances on Warden and nothing depends on users being able to create them, so removing that path closes the precondition rather than relying on the reconstruction being correct”
In the article
…because the fork carried duplicate unexported helpers while the upstream change touched only the exported one. Warden Protocol took the other route two days later and blocked vesting-account creation outright. " Vesting accounts are the only source of locked balances on Warden and nothing depends on users being able to create them, so removing that path closes the precondition rather than relying on the reconstruction being correct ," Warden Protocol contributor jlehtimaki said in a commit message. A public pull request in Push Chain's fork of Cosmos EVM described the vulnerability and its exploitation path in detail at 07:16 UTC on August 20,…
Coverage1
All filed from IndiaSingle origin
Named India · MANTRA · Cosmos Labs · Push Chain · Warden Protocol · ZetaChain
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.