Cosmos EVM Vulnerability — August 2026 Six-Chain Exploit
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·35yDWu…XcQdSummary
A critical integer underflow vulnerability (GHSA-7g4w-cg88-2cq2) in the shared Cosmos EVM module was reported via bug bounty on April 25, 2026, but was incorrectly assessed by Cosmos Labs as posing no risk to live production networks. Between August 20 and August 25, 2026, attackers exploited the flaw across six Cosmos EVM-based blockchains, draining approximately $5.72 million in total. Cosmos Labs confirmed in its August 28 post-mortem that its initial clearance of the bug was in error, and that its patch-release process failed to provide downstream chains adequate notice to upgrade before exploitation began.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(15 events)
25 April 2026
Vulnerability (GHSA-7g4w-cg88-2cq2) reported via Cosmos Labs HackerOne bug bounty program.
Cosmos Labs Post-Mortem25 April 2026
Cosmos Labs assessed the bug as posing no risk to live production networks, citing the belief that only non-18-decimal chains were affected; issued via silent patch process.
Cosmos Labs Post-Mortem15 May 2026
Underflow fix merged to cosmos/evm main branch (PR #1176) as a silent patch with no public security advisory.
Cosmos Labs Post-Mortem20 May 2026
Balance snapshot fix merged (PR #1187); no coordinated disclosure to downstream chains.
The Hacker News13 August 2026
Cosmos Labs confirmed internally that all Cosmos EVM chains, regardless of decimal configuration, were at risk from the vulnerability.
Cosmos Labs Post-Mortem19 August 2026
Patched releases v0.6.2 and v0.7.2 published at 23:01 UTC with release notes that did not specify the security nature of the changes.
Cosmos Labs Post-Mortem20 August 2026
Push Chain fork's public pull request (PR #40) published at 07:16 UTC, describing the vulnerability and exploitation path in detail — approximately 8 hours 15 minutes after patch release and more than 11 hours before the first confirmed attack.
Cosmos Labs Post-Mortem20 August 2026
MANTRA chain attacked at 19:06 UTC; 720.9 million MANTRA tokens (~$3.6 million) drained from the network's burn address and a dormant multisig wallet. MANTRA monitoring did not flag the attack for nearly four hours.
The Block20 August 2026
MANTRA chain halted at approximately 7:13 p.m. ET; approximately 38 million MANTRA frozen in the attacker's wallet.
crypto.news21 August 2026
Cosmos Labs sent first private security notification email to known contacts at 03:36 UTC — approximately 8.5 hours after the first confirmed attack.
Cosmos Labs Post-Mortem22 August 2026
TAC attacked at approximately 19:46 UTC; nearly 3 billion TAC tokens drained from a single account; approximately 1.2 billion TAC sold for ~$950,000.
crypto.news22 August 2026
KiiChain attacked at approximately 22:50 UTC; attacker repeated the exploit 18 times draining 148,326,583 KII before chain halted at block 9355723; approximately 64.6 million KII sold for ~$1.6 million.
crypto.news25 August 2026
Exploitation window closed; six chains confirmed affected with total losses of approximately $5.72 million.
Cosmos Labs Post-Mortem26 August 2026
Blockchain analytics firm Bubblemaps identified Nesa as an additional affected chain; Nesa attacker reportedly profited approximately $60,000 and was funded via Monero.
crypto.news28 August 2026
Cosmos Labs published post-mortem acknowledging the April 2026 clearance was incorrect, describing two chained vulnerabilities, confirming centralized exchange accounts frozen, and identifying the lack of a complete downstream chain registry as a contributing factor.
Cosmos Labs Post-MortemDecision Log
- hash: 9EbTEHFq2hLwgbi47gfJehrUyvrEave5F37kAz49dcXZ
This investigation is cryptographically anchored to the Solana blockchain (1 event). 12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/16/2026, 5:05:02 PM
last updated: 9/16/2026, 7:56:09 PM
avoid.net — verified advice for a post-truth world