Ethical Hacking News
Cosmos Labs has been left red-faced after a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score. The affected versions are < 0.6.2 and >= 0.7.0 < 0.7.2, and the fix shipped in v0.6.2 and v0.7.2 on August 19. Chain operators are told to upgrade to one of those releases or later, a change that is state-breaking and requires a coordinated network upgrade. Attackers sold approximately USD 2.87 million in affected assets on decentralized exchanges based on August 19 prices, a figure the company said was supplied by the affected chains and has not been independently audited. A further USD 2.85 million was sold on centralised exchanges, an estimate Cosmos Labs based on publicly available volume data. Operators running Cosmos EVM are advised to take the following steps: Upgrade, Halt, Chains that cannot upgrade at once are told to stop block production, Close the precondition, Reject MsgCreateVestingAccount, Verify the live code path on a fork, A cherry-pick that patches only the exported helper can leave a duplicated unexported copy in place while every test still passes, Apply the two fixes the advisory omits, The locked-balance snapshot and the module-account guard are separate changes, and the module-account guard rejects module accounts unconditionally, which breaks EVM calls made from a module account. Register a security contact with Cosmos Labs, which learned of eleven Cosmos EVM deployments during the incident that had never registered with its security channels.
Cosmos Labs has announced a critical balance-handling flaw in the shared Cosmos EVM module that was exploited to drain funds from six blockchains. The vulnerability, GHSA-7g4w-cg88-2cq2, is rated Critical and was published without a CVE identifier, weakness classification, or CVSS score. Affected versions are < 0.6.2 and >= 0.7.0 < 0.7.2, with a fix shipped in v0.6.2 and v0.7.2 on August 19. Chain operators are advised to upgrade to one of the affected releases or later, or halt the chain if immediate upgrade is not possible. The exploit allows attackers to drain funds by moving a finite amount out of a wrapped account or sending a victim account a balance that causes reconciliation to burn the victim's real holdings. Operators are advised to take steps such as upgrading, halting the chain, closing the precondition, rejecting certain messages, and applying patches to fix the vulnerability.
Cosmos Labs has been left red-faced after a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score.
The affected versions are < 0.6.2 and >= 0.7.0 < 0.7.2, and the fix shipped in v0.6.2 and v0.7.2 on August 19. Chain operators are told to upgrade to one of those releases or later, a change that is state-breaking and requires a coordinated network upgrade.
Operators who cannot upgrade immediately are told to halt the chain rather than attempt a coordinated governance upgrade. The advisory states there is no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but is not a substitute for the patch.
Cosmos Labs said it is aware of six chains on which the exploit was leveraged, and attackers sold approximately USD 2.87 million in affected assets on decentralized exchanges based on August 19 prices, a figure the company said was supplied by the affected chains and has not been independently audited. A further USD 2.85 million was sold on centralised exchanges, an estimate Cosmos Labs based on publicly available volume data.
The Cosmos ecosystem spans over 115 known public blockchains, and the company said it holds no complete registry of the networks running its software, the same gap that left downstream vendors to patch bundled filesystem flaws in July.
Cosmos Labs has warned that the critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score.
The affected versions are < 0.6.2 and >= 0.7.0 < 0.7.2, and the fix shipped in v0.6.2 and v0.7.2 on August 19. Chain operators are told to upgrade to one of those releases or later, a change that is state-breaking and requires a coordinated network upgrade.
Operators who cannot upgrade immediately are told to halt the chain rather than attempt a coordinated governance upgrade. The advisory states there is no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but is not a substitute for the patch.
The vulnerability sits in the code that reconciles Ethereum Virtual Machine (EVM) state with the Cosmos SDK x/bank module. The EVM StateDB tracks only an account's spendable balance, while vesting accounts in SDK state hold both a spendable and a locked balance. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. The subtraction is unchecked, and the balance wraps to roughly 2^256.
Reconciliation then mints on a positive delta and burns on a negative one. The attacker can move a finite amount out of the wrapped account, or send a victim account 2^256 minus its balance so that reconciliation burns the victim's real holdings.
Chains on 0.6.x mint and burn on the backing SDK ledger, so a large mint causes a supply overflow that halts the chain. Chains running 0.7.x set balances directly in x/bank and accept changes that survive a uint256 to int256 conversion.
Both halves run inside a single transaction with a net supply change of zero, from a contract deployed onto a precomputed address that was first turned into a vesting account. Exploitation requires the chain to permit permissionless vesting-account creation.
Operators running Cosmos EVM are advised to take the following steps:
- Upgrade to v0.6.2 or v0.7.2 or later, applying it as a coordinated network upgrade because the change is state-breaking.
- Halt rather than vote.
- Chains that cannot upgrade at once are told to stop block production instead of running a coordinated governance upgrade. The advisory states there is no configuration-only mitigation, and that disabling the staking precompile removes the primary trigger path but is not a substitute for the patch.
- Close the precondition.
- Reject MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount in the ante handler. Vesting accounts defined in genesis are unaffected.
- Verify the live code path on a fork.
- A cherry-pick that patches only the exported helper can leave a duplicated unexported copy in place while every test still passes.
- Apply the two fixes the advisory omits.
- The locked-balance snapshot and the module-account guard are separate changes, and the module-account guard rejects module accounts unconditionally, which breaks EVM calls made from a module account.
- Register a security contact with Cosmos Labs, which learned of eleven Cosmos EVM deployments during the incident that had never registered with its security channels.
Related Information:
https://www.ethicalhackingnews.com/articles/Cosmos-EVM-Vulnerability-A-Critical-Balance-Handling-Flaw-Exploited-to-Drain-Funds-from-Six-Blockchains-ehn.shtml
https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html
Published: Sat Aug 29 17:12:36 2026 by llama3.2 3B Q4_K_M
