Cosmos EVM vulnerability: six blockchains stolen $5.72 million, three chains forced to suspend

If you hold tokens on a smaller blockchain, your balance depends on two factors: the blockchain itself, and the software it shares with numerous other blockchains. The events of August revealed this. Between August 20 and 25, 2026, vulnerabilities in a shared building module called Cosmos EVM were exploited on six blockchains. About $5.72 million was stolen, three chains were suspended, and Cosmos Labs said it had contacted 40 networks. On August 28, the team publicly released a post-mortem analysis report, describing the incident in detail. This article will explain what happened, why the amount of losses in circulation varied so widely, and what you can check if you hold tokens on the affected chain.

Cosmos EVM vulnerability overview: US$5.72 million lost on six chains

Cosmos EVM is a software module that extends the Cosmos blockchain to an Ethereum-compatible execution environment. "Module" here refers to a complete code package that chain teams can integrate into their own blockchain without having to write the functionality themselves. The advantage is speed, but the cost is shared dependency: vulnerabilities in a module can affect every chain that uses the module.

The vulnerability's identifier is GHSA-7g4w-cg88 - 2cq2, which Cosmos Labs itself rated as severe. According to The Hacker News, the vulnerability was released without a CVE number, vulnerability classification and CVSS score. Affected versions include versions below 0.6.2 and versions between 0.7.0 and 0.7.2 (excluding); the vulnerability has been fixed in versions 0.6.2 and 0.7.2, which were released on August 19, 2026.

Cosmos Hub and its token ATOM are not affected because the chain does not run this module. The risk of confusion does exist because the word "Cosmos" appears in both names, which partly explains last week's uncertainty.

Balance reconciliation and overflow: Technical principles of the Cosmos EVM vulnerability

The vulnerability exists at the junction between two sets of ledgers. The Cosmos blockchain maintains balances in the x/bank module, while the Ethereum environment maintains balances in parallel in its own state database, StateDB. After every transaction, both must display the same number, and it is this reconciliation process that went wrong.

According to The Hacker News, problems arise when the amount entrusted by the so-called "vested account" exceeds its available balance. An attribution account is an address where tokens are released as scheduled; some holdings are locked and some are freely available. When writing back data after delegation, the code subtracts the entire delegation amount from the smaller available balance without checking whether the result may be positive.

Next is a classic problem in computer arithmetic. Subtracting a number that exceeds itself from an unsigned number does not turn into a negative number, but jumps to the upper limit of the range of values. A small deficiency can turn into a balance on the order of 2 to the 256th power. An attacker could then withdraw funds from this overflowing account or send a calculated amount to another account, allowing the reconciliation process to destroy the account's holdings.

What is a shared module in blockchain

Shared modules refer to program code obtained by multiple independent blockchains from the same source and integrated into their own software. For you as a holder, this means that whether your chain is safe cannot be judged solely by the credibility of your team. It also depends on which external building modules the team uses and how quickly they apply updates.

Why attributed accounts are a breakthrough

attributed accounts are very common in young networks because teams, investors and early contributors are usually allocated in stages. Therefore, this is a regular account type maintained by almost all new chains, rather than a marginal exception. This is one of the reasons why Cosmos Labs advised affected networks to temporarily refuse to create new home accounts.

Four months from report to alert: timeline for post-mortem analysis

The event timeline comes from Cosmos Labs 'own post-mortem analysis report on August 28, 2026, and the transaction report that evaluates it. This is also the fundamental reason why the case has been widely discussed beyond a single incident.

On April 25, 2026, a report was received through the Vulnerability Bounty Program. At the time, the assessment concluded that the loophole did not pose a risk to funds on the production network. CryptoSlate reported that on May 15, a fix was merged into the main branch in a silent manner (i.e., not marked as security critical). On August 13, the team internally confirmed that all Cosmos EVM chains were affected, regardless of their decimal configuration.

On August 19, the repaired version was released. At 07:16 UTC on August 20, the first public description of the attack path appeared; at 19:06 UTC on the same day, the first unauthorized operation occurred on MANTRA. According to the reconstructed timeline, the first private notification from the affected chain was issued at 03:36 UTC on August 21, approximately two hours after MANTRA reported the incident. On August 24, the verifier was publicly called on to suspend its chain operation. For chains that do not have a rapid update path, suspending operations is the recommended emergency measure: it is better to remain silent than to be exposed.

Notional value and actual benefits: Why are the huge differences in the amount of Cosmos EVM hacking losses

If you browse relevant reports, you will find that the amount ranges from just under 2 million to more than 9 million US dollars. This depends on the measurement and is not contradictory; it is valuable to distinguish this because it repeats itself in every exploit report.

The oft-quoted approximately $5.72 million refers to the amount actually cashed out by the attacker: approximately $2.87 million passed through decentralized exchanges and approximately $2.85 million passed through centralized trading platforms, calculated at the August 19 exchange rate. A significantly higher number represents the nominal value of the stolen token before the incident.

The difference stems from the selling pressure itself. According to Protos, on KiiChain, the chain claimed that 148,326,583.15 KIIs were stolen, with a nominal value of approximately US$9 million, but only approximately US$1.6 million were obtained after sale. Therefore, when reading such reports, always check whether stolen tokens or realized gains are being discussed.

MANTRA, KiiChain, and TAC: What Happens on Three Known Chains

Currently, three of the six utilized networks have been publicly named. MANTRA suspended the chain at block 17,449,398 on August 21 and restored the block with version 8.4.0 on August 22. Restart times are circulated between 03:38 and 05:30 UTC; we used earlier values in our August 22 report on MANTRA chain suspensions and frozen withdrawals. The team said user balances were not affected and two controlled addresses were affected. CryptoSlate said the nominal value of the MANTRA incident was approximately US$3.6 million and involved 720.9 million tokens. These two numbers coexist and we will not reconcile them.

KiiChain paused at block 9,355,723. According to it, the same technology has been applied eighteen times in a row. TAC was suspended on August 22 at block 24,671,475, and the team stated that one account was cleared. In both cases, the chain team traced the cause to the shared Cosmos EVM code rather than its own logic.

In addition to the three named chains, Cosmos Labs reported that 13 potentially affected chains were updated, suspended or hardened before the attack occurred. Another 11 module installation instances were completely unaware of the team before the incident and were only discovered during the review process.

Chain pause as an emergency measure: Why Cosmos Labs recommends that verifiers stop

Chain pause means that verifiers stop blocking; the network will no longer process any transactions until it coordinates a restart. To the outside world, this looks like getting out of control. But in this case, this is a conservative choice.

The reason lies in chronological order. Regular network upgrades through governance voting can take hours to days, and during this time the attack path has been publicly described and the vulnerability will remain. Therefore, Cosmos Labs recommends that operators immediately update to v0.6.2, v0.7.2 or higher, and if it cannot be updated immediately, suspend block-out rather than trying to coordinate voting. In addition, the team also recommended refusing to create home accounts in ante handler, checking fixes in both exported and unexported code paths, and registering security contacts.

This has a practical consequence that can easily be ignored for you as a holder: suspended chains are a warning signal about the status of the software, but not an automatic signal about your account balance. Whether your holdings have been changed is two different things from whether you are currently issuing blocks.

Silent patches and bug bounty: This case reveals which problems in the disclosure process

Programming errors themselves are not controversial among interested parties. The controversy lies in the order of disclosure. Silent patches are a common practice to apply fixes quietly to prevent attackers from knowing the attack point from the notification itself. This is effective only if the operator running the code knows in advance that they need to take action.

KiiChain made this clear in its own post-mortem analysis. It believes that publicly releasing security fixes before the chain running the code is privately notified and given update time is tantamount to passing on the vulnerability to anyone who reads the submission information. The chain attributed the reasons to lack of advance notice, failure to mark fixes as critical, and delayed communication. This is the subjective judgment of the affected party, and we hereby report it truthfully.

Cosmos Labs states in its own bounty rules that emergency measures should be initiated when there is an immediate or network-wide risk. Post-mortem analysis describes why the standard path was chosen for no-financial loss cases. How this assessment was arrived at is an outstanding issue raised in the document, and the outside world cannot make a final judgment. The timeline is documented; the evaluation is left to the relevant team. The report has been available since April 25: less than four months have elapsed since the reward program received the report to the public call for a suspension of the chain on August 24.

What should affected token holders check immediately

If you hold another token on the OM, KII, TAC or Cosmos EVM chain, the top priority is to understand the current situation rather than react quickly in the market. Please proceed in order.

Step 1, check the network status. Use the public block browser for the relevant chain to see if the block height is still growing or stopping at a certain value. If it stops, it means that the chain has not been released and no transactions will be confirmed during this period.

The second step is to check which version your chain is running and whether the team has announced a reboot on a fixed version. Chain teams usually publish such information through their status pages or official channels. Without such a statement, this would be a message in itself.

Step 3, separate from the above steps, check whether your trading platform has resumed recharge and withdrawal of affected tokens. These two states are related but not the same thing, and this is where most misjudgments occur. If you want to have your holdings freely controlled independently of the exchange, you need to do so through self-custody; you can refer to the content we provide for which equipment is suitable.

Three states to be distinguished

The first state About the chain: Is it emerging? The second status is about your balance: Does your address still show the amount you expected? The third status is about the trading platform: Can you recharge or withdraw cash? Running chains and frozen exchange withdrawals are a common combination because trading platforms independently decide when to reopen the gateway after an incident. Conversely, suspended chains may also carry unchanged balances.

How to determine whether a blockchain relies on shared building blocks

You can solve this problem before purchasing in just a few minutes. The first clue is the chain's documentation: If it says the chain is based on frameworks such as the Cosmos SDK and achieves EVM compatibility through modules, then it shares code with other networks.

The second clue is the public code warehouse. Blockchains usually expose their software, and dependency files list which external packages are included and their versions. You don't need to read the code, just see the version number and compare it with the currently recommended version.

The third clue is communication channels. Does the chain have status pages, security contacts, and post-event analysis records of past incidents? The current case shows that this is crucial: There are 11 instances of module installation that are not even known to the publisher, which means it cannot warn these operators in an emergency. The technical description of this vulnerability can be read in the security bulletin GHSA-7g4w-cg88 - 2cq2, and the timeline can refer to the relevant reconstruction content.

Taxation and Evidence: What should be recorded after a chain suspension

The network suspension was not originally a tax event. As long as your holdings have not changed, there will be no disposals or losses that need to be reported. It only becomes relevant if you actually sell it due to an event, or if the token disappears from your address.

In practice, this means that records can be saved in a timely manner right now at your fingertips. Including a screenshot of your account balance (including date and time), the transaction ID of the relevant operation, your exchange's status notification on the frozen gateway, and a public statement from the chain team. If you later liquidate your position at a loss, or need to explain to the tax authority why your holdings no longer exist, the validity of the evidence depends on the information you captured at the time of the incident.

This point needs to be clarified, because this problem often arises: whether the loss of holdings due to exploit can be tax deductible depends on the specific circumstances and cannot be generalized. This assessment is not a substitute for tax advice, and we do not advocate any legal position that does not exist here.

Checking Cosmos EVM vulnerabilities: Summary

This case is not so much a story of a single vulnerability as a story of shared dependencies and the speed of information transfer. You can draw three steps from this:

Check the status of your chain and exchange respectively. The height of the block in the block browser, the balance at your address, and the gateway status of the trading platform are three readings that measure different things. If during this process, you find that your provider has failed to communicate well after the incident, you can refer to the content we provide.

Before making your next purchase, check which external building modules the chain uses. Frameworks, module versions, and registered security contacts tell more about the resilience of the network than announcements. For storage outside of the exchange, you can find options in the content we provide.

Put the amount of holdings you do not actively trade out of the control of others. The frozen exchange gateway only affects the funds stored there. Which equipment is suitable and their differences can be found in the content we provide.

(As of August 29, 2026. This article does not constitute investment advice. Price and fee structures will change; please confirm terms with your provider before purchasing.)