Executive Summary
A critical vulnerability in the Cosmos EVM module has been exploited in the wild, resulting in the compromise of multiple Cosmos-based blockchains and the theft of millions of dollars in digital assets. The flaw, which was known to Cosmos Labs months before public exploitation, affected every blockchain running the vulnerable Cosmos EVM implementation. Attackers leveraged unchecked arithmetic in the reconciliation logic between the EVM StateDB and the Cosmos SDK x/bank module, enabling them to manipulate account balances and drain funds. This report provides a comprehensive technical analysis of the vulnerability, the tactics and procedures used by threat actors, observed exploitation, victimology, and actionable mitigation strategies for organizations operating or interacting with Cosmos EVM-based chains.
Threat Actor Profile
The exploitation of the Cosmos EVM flaw appears to be financially motivated and opportunistic, rather than the work of a known advanced persistent threat (APT) group. The attackers demonstrated a high degree of technical sophistication, including a deep understanding of Cosmos EVM internals, vesting account mechanics, and the nuances of cross-module state reconciliation. The threat actors rapidly weaponized the vulnerability following its public disclosure, deploying custom contracts and exploiting permissionless vesting account creation to maximize financial gain. There is no evidence at this time linking the activity to state-sponsored actors or established cybercrime syndicates; rather, the exploitation aligns with the tactics of profit-driven blockchain exploiters who monitor upstream code changes and public disclosures for lucrative opportunities.
Technical Analysis of Malware/TTPs
The exploited vulnerability, tracked as GHSA-7g4w-cg88-2cq2, resides in the Cosmos EVM module, specifically in the logic that reconciles account balances between the EVM StateDB and the Cosmos SDK x/bank module. The EVM StateDB only tracks an account's spendable balance, while the Cosmos SDK supports vesting accounts that maintain both spendable and locked balances. When a vesting account delegates more than its spendable balance, the post-delegation write-back subtracts the full delegated amount from the smaller spendable figure. Critically, this subtraction is unchecked, causing the balance to underflow and wrap to a value near 2^256 due to unsigned integer arithmetic.
During reconciliation, the system mints tokens on a positive delta and burns tokens on a negative delta. Attackers exploited this by creating vesting accounts, delegating more than the spendable balance, and triggering the underflow. This allowed them to mint vast quantities of tokens or burn tokens from victim accounts by sending them a value equal to 2^256 minus their balance, effectively erasing their holdings. The attack required the chain to permit permissionless creation of vesting accounts, a feature enabled on many Cosmos EVM-based blockchains.
The technical prerequisites for exploitation included running a vulnerable version of Cosmos EVM (all versions prior to 0.6.2 and versions 0.7.0 up to but not including 0.7.2) and allowing permissionless vesting account creation. Attackers deployed contracts to precomputed addresses, converted them into vesting accounts, and executed the exploit chain to manipulate balances and extract funds. The attack path was made public via a pull request to the Push Chain repository, which described the vulnerability and exploitation method in detail.
Exploitation in the Wild
The first public disclosure of the vulnerability occurred on August 20, 2026, when a fork of the Push Chain repository included a pull request explicitly detailing the exploit path. Within hours, the first known attack was executed against the MANTRA chain at 19:06 UTC. Over the following days, at least six Cosmos EVM-based blockchains, including MANTRA, KiiChain, and others, were compromised. The attackers drained approximately $2.87 million via decentralized exchanges and an additional $2.85 million via centralized exchanges, for a total estimated loss of $5.7 million (based on August 19, 2026, prices).
The attack timeline reveals that the flaw was originally reported to Cosmos Labs via a bug bounty on April 25, 2026. Patches were developed and merged in May 2026 (PR #1176 and PR #1187), but the fixes were not broadly or privately disclosed to all affected chains. The public release of patched versions (v0.6.2 and v0.7.2) occurred on August 19, 2026, just one day before the exploit was publicly described and attacks commenced. Cosmos Labs began private notifications to some chains only after exploitation was underway.
Indicators of compromise include anomalous minting or burning of tokens, transactions involving vesting accounts with balances wrapping to 2^256, and the rapid creation and exploitation of vesting accounts. The exploit contracts were deployed to precomputed addresses and immediately used to trigger the vulnerability.
Victimology and Targeting
The primary victims of this campaign were Cosmos EVM-based blockchains that had not yet upgraded to the patched versions of the EVM module and permitted permissionless vesting account creation. Affected chains included MANTRA, KiiChain, TAC, and at least three others whose names have not been fully disclosed. The attacks targeted the core financial infrastructure of these blockchains, resulting in direct financial losses to the chains, their users, and liquidity providers. The decentralized and global nature of Cosmos EVM chains means that the impact was not limited to a specific country or region, but rather affected a broad spectrum of stakeholders in the blockchain ecosystem.
There is no evidence that the attackers selectively targeted specific organizations or individuals; rather, the exploitation was opportunistic, focusing on any chain running the vulnerable software configuration. The rapid weaponization and broad targeting underscore the importance of timely patch management and coordinated vulnerability disclosure in decentralized environments.
Mitigation and Countermeasures
Immediate mitigation requires all Cosmos EVM-based blockchains to upgrade to Cosmos EVM version 0.6.2 or 0.7.2 (or later) as a coordinated network upgrade. This is a state-breaking change and must be executed with care to avoid further disruption. If an immediate upgrade is not feasible, chains should halt block production to prevent further exploitation rather than attempting a governance upgrade under active attack conditions.
Chains should also disable permissionless vesting account creation by rejecting MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount transactions in the ante handler. Vesting accounts defined in genesis are not affected by this mitigation. It is critical to verify that all relevant code paths, including both exported and unexported helpers, are patched and that both the locked-balance snapshot and module-account guard fixes are applied.
Long-term recommendations include reviewing patch management policies to ensure that silent patches are reserved for non-critical issues and that critical vulnerabilities are privately disclosed to all affected parties. Regular audits of vesting and delegation logic should be conducted to identify and remediate unchecked arithmetic and reconciliation flaws. All Cosmos EVM deployments should register with Cosmos Labs security channels to receive timely notifications of future vulnerabilities.
Organizations interacting with Cosmos EVM-based chains should monitor for suspicious transactions, particularly those involving large, anomalous minting or burning of tokens and vesting accounts with balances near 2^256. Incident response plans should be updated to include procedures for rapidly upgrading blockchain software and coordinating with upstream vendors in the event of critical vulnerabilities.
References
The following sources provide additional technical details and context for the Cosmos EVM vulnerability and its exploitation:
The Hacker News: Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
Reddit: Cosmos EVM Flaw Exploited After Cosmos Labs Knew
CryptoSlate: Cosmos misjudged a critical bug for 4 months before hackers stole nearly $6 million across 6 chains
Cosmos Labs on X (Twitter): @cosmoslabs_io
Cosmos Labs Post-Mortem (August 28, 2026): The Hacker News
GitHub Pull Requests: #1176, #1187
About Rescana
Rescana is a leader in third-party risk management (TPRM) for digital ecosystems. Our platform empowers organizations to continuously monitor, assess, and mitigate cyber risks across their extended supply chain, leveraging advanced analytics and threat intelligence to provide actionable insights. We are committed to helping our clients stay ahead of emerging threats and maintain the resilience of their critical infrastructure.
For further questions or incident response support, please contact us at info@rescana.com.
