Cosmos EVM Bug Drained Six Blockchains Over Five Days in August 2026
A critical balance-handling flaw in the shared Cosmos EVM module let attackers siphon funds from six chains between 20 and 25 August 2026, and the advisory landed without a CVE or CVSS score.
Key points
- Cosmos Labs confirmed a critical flaw in the shared Cosmos EVM module was exploited on six blockchains between 20 and 25 August 2026.
- The advisory is tracked as GHSA-7g4w-cg88-2cq2 and was published without a CVE ID, a weakness category or a CVSS score.
- Affected versions are anything below 0.6.2.
- The bug sat in balance handling, the code that tracks how much money each account holds.
- Cosmos Labs rates the issue Critical and urges operators of any chain running Cosmos EVM to upgrade immediately.
A shared piece of blockchain plumbing built by Cosmos Labs was broken for days in August, and attackers used it to walk off with funds from six separate blockchains.
Cosmos Labs disclosed the flaw in an advisory tagged GHSA-7g4w-cg88-2cq2, rated Critical, with an exploitation window from 20 to 25 August 2026.
The flaw lives in the Cosmos EVM module, which lets chains built on the Cosmos framework run Ethereum-style smart contracts: small programs that move money between accounts. The problem was in balance handling, the accounting logic that decides how much a wallet holds after a transfer. Get that wrong, and an attacker can end up with more coins than they started with.
What went wrong, in plain terms?
Cosmos Labs ships shared code that every chain running Cosmos EVM inherits. When that shared code miscounted balances, every chain using it was exposed at the same moment. Attackers hit six of them over five days.
Think of it as a bank vendor selling the same faulty till software to six branches. Once someone works out the trick at one branch, it works everywhere the till is installed.
As The Hacker News noted, chains running the vulnerable release didn't need to do anything wrong themselves. Inheriting the module was enough. That pattern is familiar: our 6 August story "A 12-year-old flaw in a popular crypto library drained $5.7 million from wallets" traced a similar blast radius, where one upstream library's weakness hit five separate wallet apps simultaneously.
Why is there no CVE number?
Cosmos Labs didn't request one. The GitHub advisory was published without a CVE identifier, a CWE weakness category or a CVSS score, which makes automatic triage harder.
Security teams relying on CVE feeds to flag vulnerable dependencies may miss this entirely until someone maps the GHSA identifier into their tooling by hand. That's a real operational problem for chain operators and auditors.
Which versions are affected?
Anything below 0.6.2. Operators should move to 0.6.2 or later. The advisory is the source of truth on exact version constraints.
| Fact | Detail |
|---|---|
| Advisory ID | GHSA-7g4w-cg88-2cq2 |
| Severity | Critical (vendor rating) |
| CVE / CVSS | None assigned |
| Fixed version | 0.6.2 |
| Exploitation window | 20 to 25 August 2026 |
| Chains hit | 6 |
Should you worry if you hold tokens on an affected chain?
Check the chain's official channels for a post-incident statement. You're looking for two things: whether the chain has upgraded past 0.6.2, and whether user funds were affected or reimbursed.
Don't rush to move assets through bridges or swaps while chains are still stabilising. Bridge contracts can behave oddly right after a patch, and that's exactly when phishing sites impersonating official bridges tend to appear. If a chain hasn't confirmed it's patched, treat it as exposed.
Operators running Cosmos EVM should upgrade to 0.6.2 or later without waiting for a CVE to appear in their scanner. Then audit balances against expected supply. If the numbers don't add up, assume exploitation and work with exchanges to freeze suspicious flows.
The broader lesson here is the one this beat keeps teaching: shared infrastructure is a force multiplier for attackers as much as for developers.
