Six blockchains were drained between 20 and 25 August 2026 through a critical flaw in Cosmos EVM, tracked as GHSA-7g4w-cg88-2cq2. No CVE was assigned.
The bug is a balance reconciliation failure between the EVM StateDB and the Cosmos SDK's bank module. Where a vesting account delegates more than its spendable balance, an unchecked subtraction underflows to roughly 2 to the power of 256 — after which an attacker can move funds out of wrapped accounts or force reconciliation to burn someone else's holdings.
Affected versions are below 0.6.2, and 0.7.0 up to 0.7.2.
The decision this turns on
25 April: reported through the bug bounty programme.
Cosmos Labs then, by its own account, incorrectly concluded that the flaw affected only non-18-decimal networks and posed no risk to live networks.
13 August: the team confirms that all Cosmos EVM chains are affected regardless of decimal configuration.
19 August: patches ship as v0.6.2 and v0.7.2 — through the ordinary release process.
20 August: a public pull request in a fork of the code discloses the vulnerability details and the exploitation path.
20–25 August: six chains are drained. MANTRA is the one named publicly.
So the sequence is: learn that user funds on every live network are at risk, then publish the fix in a way that tells attackers what to look for before it tells operators to hurry.
Their own policy says otherwise
Cosmos Labs' published policy reads that when an issue presents an immediate or network-wide risk, it will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs.
The post-mortem acknowledges the same standard, noting that for a vulnerability known to threaten user funds in production networks the team would typically use secure channels to distribute a patch privately.
It used the silent patch process instead. The gap between the written policy and what happened is the finding, and it is Cosmos Labs' own document that establishes it.
Why silent patching fails here specifically
Silent patching — fix quietly, describe vaguely, let downstream upgrade before anyone works it out — depends on two things. Downstream operators must upgrade promptly, and nobody must reverse the fix before they do.
Neither held. A public pull request in a fork laid out the exploitation path the day after release. And Cosmos Labs holds no complete registry of the networks running its software: during the incident it discovered 11 Cosmos EVM deployments that had never registered a security contact.
You cannot privately notify people you cannot enumerate. That is the structural problem underneath the process failure, and it is not fixed by choosing better next time.
For context on how routine the approach is: Cosmos Labs has released patches for 37 vulnerabilities silently in the last 13 months.
The patches themselves were incomplete
Three related fixes exist. Only one appears in the official release notes.
| Fix | Date | Status |
|---|---|---|
| PR #1176, SubBalance underflow guard | 15 May | backported 13 August |
| PR #1187, snapshots locked balance | 20 May | backported same day |
| Commit 3524ebc, rejects module account balance changes | — | never formally backported |
A ZetaChain contributor reported that the cherry-picked patches left live code paths unpatched, because duplicate unexported helpers existed that the cherry-pick did not cover.
Two of those fixes were written in May — before the August reassessment — and sat unbackported while the team believed the issue was not live-network relevant.
What was actually lost
Roughly $2.87 million sold on decentralised exchanges and $2.85 million on centralised ones, at 19 August prices — about $5.72 million total.
Cosmos Labs states these figures were supplied by the affected chains and have not been independently audited, which is worth carrying with the number.
Exploitation also required permissionless vesting-account creation, which is a configuration choice rather than a property of the software. Chains that did not allow it were not exposed by that path.
A note on the timeline
Hour-level timings for the first attack are circulating that do not reconcile with the day-level dates in the same accounts — one figure implies the attack preceded a notification that other figures place after it. We have used only the day-level sequence, which is consistent, and are not reproducing an interval we cannot make add up.
What is not established
- Why the patch was not distributed privately after 13 August. The question has been put to Cosmos Labs; no answer published.
- Which five other chains were drained. Only MANTRA is named.
- Whether the figures are accurate. Self-reported, unaudited.
- Who carried out the exploitation. No attribution.
- How many of the 37 prior silent patches carried comparable risk.
