The Cosmos EVM Exploit Explained: One Bug, Six Chains

Video transcript

In August 2026, one bug in shared Cosmos EVM code hit six chains in under five days. The fix had been public since May.

Reported in April, the bug was patched silently after Cosmos Labs could not reproduce theft on 18 decimal chains. Releases shipped August 19, and MANTRA was hit the next day.

An attacker's vesting account delegates more than its spendable balance through the staking precompile. An unchecked subtraction wraps the balance to a huge number. Sending that to a victim leaves the attacker holding the victim's balance.

Cosmos Labs' two estimates of tokens sold add up to about 5.7 million dollars. The decentralized exchange figure is unaudited, and the post-mortem gives no total.

A silent patch is still public. One failed test set the pace, no one had a full deployment list, past audits missed the bug, and forks had to check their own code.

Upgrade to the fixed releases and confirm the live path on your fork, or halt the chain if you cannot. Disabling the staking precompile removes the main trigger, but does not replace the patch.

Guardian's Managed Security lists this case among its recent advisories. It matches disclosures to your system in real time, and a Guardian engineer confirms exposure and helps you patch.

Read the full article, or talk to Guardian about Managed Security at guardian.security.

Cosmos EVM is shared code that lets Cosmos SDK chains run an EVM. Each chain that uses it inherits its bugs.

In August 2026, one of those bugs was exploited on six chains in under five days.

The fix had been on the public main branch since May. The fixed releases shipped on August 19.

What Happened

On April 25, 2026, the bug was reported through the Cosmos bug bounty program on HackerOne.

Cosmos Labs could not reproduce theft on networks using 18 decimals, and every known production network used 18 decimals.

It "incorrectly concluded that the vulnerability could only result in theft of funds on non-18 decimal networks," its post-mortem says.

So the bug went on the silent patch track. The fix merged to the public main branch on May 15, but was not immediately backported, because it was state-breaking.

More reports arrived in early August. By August 13, Cosmos Labs had confirmed that every chain was affected, The Hacker News reports.

Fixed releases, v0.6.2 and v0.7.2, shipped on August 19.

The next morning, a public pull request in Push Chain's fork described the exploit path.

About 12 hours later, the first attack hit MANTRA.

How the Exploit Worked

Cosmos EVM keeps EVM balances in step with the chain's bank module. Its StateDB tracks only spendable balances.

Vesting accounts also hold locked tokens. The staking module and the staking precompile let them delegate those locked tokens too.

The post-mortem describes the attack in one transaction:

1. Precompute a contract address and create a vesting account at it.
2. Deploy the attack contract to that address.
3. Delegate more than the spendable balance through the staking precompile.
4. An unchecked subtraction wraps the balance to about 2²⁵⁶.
5. Send that wrapped balance to a victim, such as a genesis multisig.
6. The overflow nets out: the victim is left with zero, and the attacker holds the victim's balance.

Total supply did not change. On 0.6.x chains, the large mint overflowed supply and halted the chain; 0.7.x chains accepted the change.

The Hacker News notes that the attack needs a chain that allows anyone to create vesting accounts.

For why precompiles are a weak point in modified EVMs, see our guide to custom EVM audits.

Timeline and Losses

What was taken

Per Cosmos Labs' post-mortem, attackers swapped stolen tokens for about $2.87M on DEXes, at August 19 prices. That figure is unaudited.

Cosmos Labs estimates a further $2.85M was sold on centralized exchanges, from public volume data.

Added together, the two estimates come to about $5.7M. The post-mortem itself gives no total.

The attackers' exchange accounts were frozen pending investigation.

Both estimates count what was sold. Much of what was taken was not:

• TAC: about 2.99 billion TAC withdrawn from the bonded tokens pool; about 1.66 billion stayed unsold.
• KiiChain: about 148.3 million KII withdrawn over 18 iterations; about 80.7 million was described as recoverable.

Thirteen other potentially exposed networks patched, halted or applied mitigations without further incidents.

What It Shows

A silent patch is still public. The May fix sat on the public main branch for three months before it reached the release branches.

One failed reproduction set the pace. A test that could not reproduce theft on 18-decimal chains put a critical bug on the slow track.

No one had the full list. Cosmos Labs says it has no complete registry of deployments. During the exploit, it learned of eleven more Cosmos EVM deployments that had not previously registered.

Audits are snapshots. The code had been audited, but those audits did not find this bug, per the post-mortem.

Forks must check their own code path. On August 21, one fork's port of the fixes left its live path unpatched, The Hacker News reports.

For more exploits that came after a public fix, see our study of time to exploit in crypto.

Checks for Cosmos EVM chains

• Run v0.6.2, v0.7.2 or later, and confirm the live code path on your fork.
• If you cannot upgrade, halt the chain. The advisory lists no configuration-only mitigation.
• Disabling the staking precompile removes the main trigger, but does not replace the patch.
• Consider rejecting vesting-account creation messages in the ante handler.
• Make sure Cosmos Labs' security team can reach you before the next advisory.

How Guardian Matches Advisories

The Cosmos EVM case is one of the recent advisories listed on Guardian's Managed Security page.

Managed Security ingests vulnerability disclosures in real time and matches them against your system. As the walkthrough puts it: "Every advisory matched to what you run, and patched with you."

Where one reaches you, a Guardian engineer confirms the exposure and works with you to patch it immediately.

For how teams follow live incidents more broadly, read how to track crypto hacks in real time.

Frequently Asked Questions

What was the Cosmos EVM exploit?

Between August 20 and 25, 2026, attackers exploited a balance underflow in shared Cosmos EVM code on six chains. A vesting account delegating locked tokens wrapped its balance to an enormous number, which was used to take a victim's balance.

How much was lost in the Cosmos EVM exploit?

Cosmos Labs reports about $2.87M swapped on DEXes and an estimated $2.85M sold on centralized exchanges. Added together, that is about $5.7M; the post-mortem gives no total. The DEX figure is unaudited, and the attackers' exchange accounts were frozen.

Which Cosmos EVM versions fix the bug?

Versions 0.6.2 and 0.7.2, released August 19, 2026. The fix is state-breaking, so it needs a coordinated network upgrade. The advisory lists no configuration-only mitigation and says chains that cannot upgrade should halt.

Why was it exploited after a fix existed?

Cosmos Labs wrongly judged 18-decimal chains safe and patched silently. The fix reached the public main branch on May 15, but releases only on August 19. A public pull request described the exploit path the next morning.

Sources

• Cosmos Labs (GitHub): Cosmos EVM GHSA-7g4w-cg88-2cq2 Post-Mortem (August 28, 2026)
• cosmos/evm (GitHub): GHSA-7g4w-cg88-2cq2, Balance underflow in EVM StateDB (August 28, 2026)
• The Hacker News: Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable (August 28, 2026)
• Guardian: Managed Security
• Guardian: Managed Security walkthrough