Cosmos EVM Bug Drained Six Blockchains Over Five Days in August 2026
A critical balance-handling flaw in the shared Cosmos EVM module let attackers siphon funds from six chains between 20 and 25 August 2026, and the advisory landed without a CVE or CVSS score.
Key points
- Cosmos Labs confirmed a critical flaw in the shared Cosmos EVM module was exploited on six blockchains between 20 and 25 August 2026.
- The advisory is tracked as GHSA-7g4w-cg88-2cq2 and was published without a CVE ID, a weakness category, or a CVSS score.
- Affected versions are anything below 0.6.2 in the vulnerable release line.
- The bug sat in balance handling, the code that tracks how much money each account holds.
- Cosmos Labs rates the issue Critical and urges operators of any chain running Cosmos EVM to upgrade immediately.
A shared piece of blockchain plumbing built by Cosmos Labs was broken for days in August, and attackers used it to walk off with funds from six separate blockchains.
The company disclosed the flaw in an advisory tagged GHSA-7g4w-cg88-2cq2. It rates the bug Critical. The exploitation window ran from 20 to 25 August 2026.
The faulty code lives in the Cosmos EVM module. That module lets chains built on the Cosmos framework run Ethereum-style smart contracts, which are small programs that move money between accounts on the blockchain.
The problem was in balance handling: the accounting logic that decides how much a wallet holds after a transfer. Get that wrong, and an attacker can end up with more coins than they started with.
What went wrong, in plain terms?
Cosmos Labs shipped shared code that every chain running Cosmos EVM inherits. When that shared code miscounted balances, every chain using it was exposed at the same moment. Attackers hit six of them over five days.
Think of it as a bank vendor selling the same faulty till software to six branches. Once someone works out the trick at one branch, the same trick works everywhere the till is installed.
As The Hacker News noted in its own reporting, chains running the vulnerable release did not need to do anything wrong themselves. Inheriting the module was enough.
Why is there no CVE number?
Because Cosmos Labs did not request one, and the GitHub advisory was published without it. There is also no CWE weakness category and no CVSS score attached to the record, which makes it harder for downstream teams to triage automatically.
Security teams that rely on CVE feeds to flag vulnerable dependencies may miss this one entirely until someone maps the GHSA identifier into their tooling by hand. That is a real operational problem for chain operators, exchanges, and auditors.
Which versions are affected?
Anything below 0.6.2 in the affected release line. Operators should move to 0.6.2 or later. The advisory is the source of truth on the exact version constraints.
| Fact | Detail |
|---|---|
| Advisory ID | GHSA-7g4w-cg88-2cq2 |
| Severity | Critical (vendor rating) |
| CVE / CVSS | None assigned |
| Fixed version | 0.6.2 |
| Exploitation window | 20 to 25 August 2026 |
| Chains hit | 6 |
What should users of affected chains do?
If you hold tokens on a Cosmos-based chain, check the chain's official channels for a post-incident statement. Look for two things: whether the chain has upgraded past 0.6.2, and whether user funds were affected or reimbursed.
Do not rush to move assets through bridges or swaps while chains are still stabilising after an upgrade. Bridge contracts often behave oddly right after a patch, and that is exactly when phishing sites impersonating official bridges tend to appear.
If a chain you use has not confirmed it has patched, treat it as still exposed until it says otherwise.
Operators running Cosmos EVM should upgrade to 0.6.2 or later without waiting for a CVE to appear in their scanner. Then audit balances against expected supply. If the numbers do not match, assume exploitation and coordinate with exchanges to freeze suspicious flows.
