Cosmos Labs has recognized a serious mistake related to a vulnerability in its Cosmos EVM module that led to attacks on six blockchains, costing $5.7 million.
Cosmos Labs has acknowledged a significant miscalculation regarding a vulnerability in its Cosmos EVM module, which led to attacks across six blockchains and total losses of approximately $5.7 million.
Between August 20th and August 25th, attackers exploited a flaw in the Cosmos EVM, extracting funds from several Cosmos-based networks. We are committed to enhancing our security processes and appreciate the collaboration from the community…
— Cosmos Labs (@cosmoslabs_io) August 28, 2026
The vulnerability was initially reported on April 25, 2026, via a bug bounty program. Following tests, the team mistakenly concluded that production networks were secure, leading to a public fix that was not communicated to network operators. In early August, independent researchers disclosed that the flaw affected all networks using the Cosmos EVM, prompting developers to implement a disguised patch in releases v0.6.2 and v0.7.2 shortly before the first attack.
In their analysis, Cosmos Labs described the attack mechanism as involving an underflow and subsequent overflow exploitation. The attacker used a specially crafted vesting account and a malicious contract to manipulate balance calculations, ultimately transferring funds from high-balance addresses. The company confirmed that no new tokens were created and that the overall token supply remained stable.
The most significant loss was suffered by MANTRA, which reported that 720.9 million MANTRA tokens were withdrawn from a burn address and an old multi-signature wallet, totaling around $3.6 million. The MANTRA network paused operations on August 20, 2026, resuming over 30 hours later without rolling back its state. They asserted that customer accounts were not impacted, though tokens previously thought to be inactive were reintroduced into circulation.
Additionally, Cosmos Labs estimated that TAC incurred losses of 2.99 billion TAC tokens, with about 1.21 billion tokens sold on the BNB Chain for approximately $950,000. KiiChain reported a loss of about 148.3 million KII tokens, with estimates suggesting that 64.6 million were sold for around $1.6 million, while over half of the stolen tokens remained in the network and might be recovered.
Three other affected networks remained unnamed by Cosmos Labs. Both MANTRA and KiiChain voiced concerns about the vulnerability disclosure process, noting that the 20-hour window for assessing and coordinating updates among validators was insufficient. KiiChain criticized the timing of the network halt recommendation, which came only after three blockchains had already been attacked.
In response to the situation, Cosmos Labs stated that it had worked with 40 networks and identified 11 unregistered deployments of Cosmos EVM among over 115 public blockchains. For context, cryptocurrency platforms lost $3.63 billion in 245 documented incidents from January 2025 to July 2026, according to CoinGecko data.
