Cosmos EVM vulnerability was exploited and $5.7 million was stolen from six chains

How are cosmic EVM vulnerabilities exploited?

Between August 20 and August 25, attackers exploited a critical vulnerability in the Shared Universe software, spanning six blockchains, to exchange stolen tokens for approximately $5.7 million in other assets, while also exposing weaknesses in security fixes communicated to networks using the Universe EVM. Cosmo Lab said about $2.87 million of the stolen money was exchanged through decentralized exchanges, and another $2.85 million was exchanged through centralized exchanges. Accounts linked to the attackers on centralized exchanges have been frozen pending investigation by authorities.

The vulnerability is an integer underflow problem in the Universe EVM, a framework that allows universal-based blockchain to run compatible with Ethereum applications. It affects Universe EVM versions before v0.6.2 and v0.7.2. The attack method is to create an account with locked tokens and then entrust more tokens than the account can actually spend. Instead of rejecting the transaction, the software allowed the balance calculation to drop below zero and overflow to approximately 2^256-1 base units, creating a huge balance in the account system. An attacker could then use this inflated balance to manipulate another account and withdraw its tokens. No new tokens were actually minted, which means that the attack exploited loopholes in accounting logic rather than directly increasing the supply of underlying tokens.

Why wasn't the vulnerability fixed earlier?

Perhaps the most critical issue lies in the disclosure timeline. A researcher originally reported the vulnerability through the Cosmic Bug Bounty Program on April 25. Cosmic Lab attempted to replicate attacks against configurations used by production networks, but concluded that there was no risk to the running chain. In May, a fix was merged into the Universe EVM main codebase through what Universe Lab calls a "silent public patch" process. The change was not immediately added to the production branch because it required a state-damaging upgrade that the chain operator needed to coordinate with the verifier to make. In early August, independent researchers provided additional information that allowed the Cosmic Laboratory to determine that all Cosmic EVM chains were vulnerable. Subsequently, the fix was reverse ported and released in v0.6.2 and v0.7.2 versions at 23:01 UTC on August 19. The first known attack on MANTRA began approximately 20 hours later. "The 20-hour window is far from enough to evaluate, build, test and coordinate a state-damaging upgrade among 38 independent validators, especially without specific recommendations for vulnerabilities," MANTRA said in its post-mortem analysis.

Investor Revelation

Compared with the major cryptocurrency vulnerability incident, the financial loss is relatively limited, but the incident exposed greater infrastructure risks: Dozens of independent blockchains may inherit the same vulnerability from shared software, but rely on their own independent groups of validators to deploy emergency upgrades.

Which cosmic chains were affected?

MANTRA suffered its largest publicly disclosed loss. The attackers removed approximately 720.9 million MANTRA pieces (worth approximately $3.6 million before the incident) from the network's destruction addresses and a dormant multi-signature wallet associated with early incentive activities. The network was suspended about four hours after the first unauthorized transfer occurred and resumed operation more than 30 hours later using patched software without rolling back the blockchain. About 38 million MANTRA pieces are still trapped in the attackers 'wallets, while most of the stolen coins have been transferred to a deposit address on a centralized exchange. The TAC was attacked on August 22, losing nearly 3 billion TACs from its pledge pool, and then about 1.2 billion tokens were sold for about $950,000. KiiChain was attacked on the same night, losing approximately 148 million KIIs, of which 64.6 million tokens were sold for approximately US$1.6 million. The Space Laboratory said that three other chains were utilized, but did not specify specific names. Nesa may also be affected because of reports that a key flaw was used to inflate token balances and transfer large amounts of NES to Ethereum, but the Cosmic Laboratory has not publicly confirmed the link.

What problems occurred in the security response?

Affected networks have focused criticism on the time lag between identifying the danger and issuing a sufficiently clear warning to operators to take action. KiiChain said chains were not initially told that the release contained critical security fixes or that it might be necessary to suspend the network. The chain stated in its post-mortem analysis: "A patch takes days for the validator set to review, build, test and deploy. It only takes a few minutes to suspend the network." Cosmos Lab also said that about 12 hours before the first attack, a downstream developer publicly described the vulnerability and its exploitation path. However, the attacker's MANTRA wallet had received funds hours before the disclosure, and MANTRA said it did not draw any conclusions based on the time point. Eventually, Cosmic Lab coordinated with 40 chains during the response and worked with another 13 chains to patch, suspend or other protective measures before their networks were attacked. The company also discovered 11 previously unregistered Cosmic EVM deployments during the incident, highlighting the difficulty of covering all projects using open source infrastructure. The immediate loophole has been fixed, but the incident has left the universe laboratory with broader coordination security issues. Future protection depends not only on discovering software vulnerabilities, but also on identifying each exposed chain and providing verifiers with enough information and time to respond before attackers act.