Verify a decision

{"actor":"system:backfill","investigation_id":"15b16f94-d000-4b20-9f9a-2f912014d57b","kind":"publish","page_slug":"cosmos-evm-vulnerability-august-2026-six-chain-exploit","published_at":"2026-09-16T17:05:16.921Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Cosmos EVM Vulnerability — August 2026 Six-Chain Exploit","sections":[{"content":"The vulnerability, designated GHSA-7g4w-cg88-2cq2 and rated Critical by Cosmos Labs, resides in the shared cosmos/evm module's reconciliation logic between the EVM StateDB and the Cosmos SDK x/bank module. Cosmos Labs describes two chained defects. The first is an integer underflow: when a vesting account attempts to delegate more tokens than its spendable balance, the SubBalance function performs unchecked arithmetic that wraps the account's balance to approximately 2^256 minus one base units. The second is an overflow: an attacker holding the inflated underflowed balance transfers it to a victim account, causing the victim's balance to wrap to near-zero while the attacker captures the difference. According to the official Cosmos Labs post-mortem, no new tokens are created; total token supply changes by at most one base unit per exploit cycle. The exploit required a two-step setup — creating a vesting account at a precomputed address and deploying a malicious contract to that address — before the balance manipulation could be executed in a single supply-neutral transaction. KiiChain has publicly disputed whether the underflow patch alone closes the attack path, asserting the exploit required three upstream defects rather than two; Cosmos Labs' post-mortem describes two chained vulnerabilities but did not directly address KiiChain's claim. MANTRA, after testing the published fix against a working reproduction, concluded the underflow repair closes the attack path.","heading":"Vulnerability Overview","severity":"critical","sources":[{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"}]},{"content":"The vulnerability was first reported through Cosmos Labs' HackerOne bug bounty program on April 25, 2026. Cosmos Labs assessed the report at the time and concluded it posed no risk to funds on live production networks, on the basis that all known production chains used 18-decimal token configurations and the team believed the underflow could only be triggered on non-18-decimal networks. The team classified the issue as non-threatening to live networks and processed it through an internal 'silent patch process' rather than through private emergency disclosure channels. Cosmos Labs confirmed in its August 28, 2026 post-mortem that this initial clearance was incorrect. Between May 15 and August 13, 2026, additional independent researchers submitted separate reports, and by August 13 the team confirmed that all Cosmos EVM chains — regardless of decimal configuration — were in fact affected. Cosmos Labs stated: 'During this exploit, we learned of eleven additional deployments of Cosmos EVM that had not previously registered with our security communication channels,' indicating no complete registry of dependent networks existed.","heading":"Bug Bounty Report and Incorrect Initial Clearance","severity":"critical","sources":[{"credibility":1,"name":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos misjudged a critical bug for 4 months before hackers stole nearly $6 million across 6 chains — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cosmos-misjudged-a-critical-bug-for-4-months-before-hackers-stole-nearly-6-million-across-6-chains/"}]},{"content":"A fix for the underflow vulnerability was merged to the cosmos/evm main branch on May 15, 2026 (PR #1176), followed by a balance snapshot fix on May 20, 2026 (PR #1187). These fixes were processed through the silent patch process, meaning no vulnerability-specific advisory was published and no private notification was sent to downstream chains at that stage. After the team confirmed on August 13 that all Cosmos EVM chains were at risk, the decision was taken to proceed with the silent release process anyway because, according to Cosmos Labs, 'the patch had already been publicly available on the main branch without known exploitation.' Versioned releases incorporating the patches — v0.6.2 and v0.7.2 — were published at 23:01 UTC on August 19, 2026, with release notes that did not specify the security nature of the changes. The first private notification email to known contacts was not dispatched until 03:36 UTC on August 21, approximately 8.5 hours after the first confirmed attack against MANTRA. Cosmos Labs' own published security policy stated it would initiate private fix distribution or coordinated upgrades before public disclosure when an issue presents an immediate or network-wide risk; it did not follow this policy in this case. MANTRA stated publicly that '20 hours was not a realistic window' for coordinating an upgrade across its 38 validators. KiiChain separately criticized the absence of immediate halt instructions, noting that halting takes minutes while applying patches takes days.","heading":"Patch Release and Coordination Failures","severity":"critical","sources":[{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"}]},{"content":"Approximately 8 hours and 15 minutes after patched versions v0.6.2 and v0.7.2 were published on August 19, a public pull request in a fork repository maintained by the Push Chain project described the vulnerability and its exploitation path in detail. According to the Cosmos Labs post-mortem, this disclosure occurred at 07:16 UTC on August 20, 2026 — more than 11 hours before the first confirmed attack against MANTRA at 19:06 UTC on August 20. The post-mortem characterized this as an inadvertent disclosure rather than deliberate publication of an exploit. Whether the attackers observed this pull request before executing the exploit has not been confirmed publicly.","heading":"Pre-Attack Public Disclosure via GitHub Pull Request","severity":"critical","sources":[{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"}]},{"content":"The first confirmed attack occurred against the MANTRA chain at 19:06 UTC on August 20, 2026. The attacker's wallet had been funded with 472.70 MANTRA tokens withdrawn from a centralized exchange. The attacker drained 720.9 million MANTRA tokens — approximately $3.6 million at prevailing prices — from two addresses: the network's burn address and a dormant multisig wallet from an earlier incentive campaign. MANTRA's monitoring systems did not flag the first attack transaction for nearly four hours because the burn address was treated as incapable of initiating transfers, leaving the attacker time to drain the second wallet. MANTRA halted its chain at 7:13 p.m. ET on August 20, freezing approximately 38 million MANTRA in the attacker's wallet; 94.7 percent of stolen MANTRA had already been transferred via 15 transactions to a single centralized-exchange deposit address. The chain resumed approximately 30 hours later on patched software without a chain rollback. TAC was attacked on August 22 at approximately 19:46 UTC, with the attacker repeating the technique to drain a single account of nearly 3 billion TAC tokens; approximately 1.2 billion TAC were subsequently sold for approximately $950,000. KiiChain was attacked the same evening at approximately 22:50 UTC; the attacker repeated the exploit 18 times, draining 148,326,583.15 KII before validators halted at block 9355723. Approximately 64.6 million KII were sold for approximately $1.6 million. A fourth confirmed chain, Nesa, was also attacked; blockchain analytics firm Bubblemaps identified Nesa as an affected chain, with the attacker reportedly profiting approximately $60,000 after purchasing $250,000 worth of NES tokens. The Nesa attacker was funded through Monero, and blockchain analysis cited by crypto.news suggested this may have been a separate actor from the MANTRA, TAC, and KiiChain attacker. The remaining two exploited chains have not been publicly named as of the post-mortem. Total losses across all six chains were approximately $5.72 million, comprising approximately $2.87 million converted via decentralized exchanges and approximately $2.85 million via centralized exchanges, based on August 19 prices. Cosmos Labs stated that centralized exchange accounts used by the attackers have been frozen pending investigation by relevant authorities. Funds have been referred to law enforcement, though no specific agency or case number has been publicly identified.","heading":"Exploit Execution and Financial Impact","severity":"critical","sources":[{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":1,"name":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks"}]},{"content":"During the incident, Cosmos Labs coordinated with 40 Cosmos chains and assisted 13 additional potentially-exposed networks with patching or halting. At least one additional network halted before funds were withdrawn, preventing further losses. Cosmos Labs established a war room with MANTRA to analyze the exploit mechanics. The security notification email was not sent until approximately 8.5 hours after the first confirmed attack — far later than Cosmos Labs' own policy contemplated for network-wide threats. The ecosystem coordination gap was compounded by the absence of a comprehensive registry: 11 Cosmos EVM deployments were identified during the incident response that had not previously registered with Cosmos Labs' security communication channels.","heading":"Downstream Chain Response and Chains Spared","severity":"high","sources":[{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains to Halt as KiiChain and TAC Attacks Raise Security Fears — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/cosmos-labs-urges-evm-chains-to-halt-as-kiichain-and-tac-attacks-raise-security-fears/"}]},{"content":"KiiChain publicly stated that the full exploit required three upstream defects rather than the two described in Cosmos Labs' post-mortem, and that only the underflow has been publicly patched. As of the August 28 post-mortem, Cosmos Labs did not directly address this claim. MANTRA's post-mortem, based on testing the published fix against a working exploit reproduction, concluded the underflow repair alone closes the attack path. The two additional affected chains beyond MANTRA, TAC, KiiChain, and Nesa have not been publicly identified. Impact figures were self-reported by affected chains and acknowledged by Cosmos Labs as not independently audited. An earlier version of the Cosmos Labs post-mortem contained an incorrect statement about the proof of concept included in the first bug bounty submission; a corrections section was added to the document. Whether the attacker who targeted Nesa (funded via Monero) is the same individual or group as the attacker on the other three named chains has not been confirmed by any public source. No law enforcement agency has been publicly named in connection with the frozen centralized exchange accounts.","heading":"Disputed Claims and Open Questions","severity":"medium","sources":[{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"}]}],"sources_used":[{"credibility":1,"name":"Cosmos Labs GHSA-7g4w-cg88-2cq2 Post-Mortem (GitHub)","type":"official","url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"credibility":1,"name":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":2,"name":"Cosmos misjudged a critical bug for 4 months before hackers stole nearly $6 million across 6 chains — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cosmos-misjudged-a-critical-bug-for-4-months-before-hackers-stole-nearly-6-million-across-6-chains/"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks"},{"credibility":2,"name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — Yahoo Finance / BeInCrypto","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains to Halt as KiiChain and TAC Attacks Raise Security Fears — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/cosmos-labs-urges-evm-chains-to-halt-as-kiichain-and-tac-attacks-raise-security-fears/"},{"credibility":2,"name":"Cosmos EVM Vulnerability: Six Chains Affected — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/cosmos-evm-vulnerability-chain-halt/"},{"credibility":2,"name":"Cosmos EVM Bug Behind $5.7M Six-Chain Hack Was Cleared Too Early — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/08/cosmos-evm-bug-cleared-before-six-chain-hack"},{"credibility":2,"name":"Cosmos EVM Exploit Hits Six Networks, Attackers Convert $5.7 Million in Stolen Tokens — CryptoWisser","type":"news_article","url":"https://www.cryptowisser.com/news/cosmos-evm-bug-drains-57m-across-six-blockchains/"},{"credibility":2,"name":"Cosmos EVM Vulnerability Exploited: Critical Flaw Leads to Multi-Chain Blockchain Attacks — Rescana","type":"research","url":"https://www.rescana.com/post/cosmos-evm-vulnerability-exploited-critical-flaw-leads-to-multi-chain-blockchain-attacks-and-5-7m-losses"}],"summary":"A critical integer underflow vulnerability (GHSA-7g4w-cg88-2cq2) in the shared Cosmos EVM module was reported via bug bounty on April 25, 2026, but was incorrectly assessed by Cosmos Labs as posing no risk to live production networks. Between August 20 and August 25, 2026, attackers exploited the flaw across six Cosmos EVM-based blockchains, draining approximately $5.72 million in total. Cosmos Labs confirmed in its August 28 post-mortem that its initial clearance of the bug was in error, and that its patch-release process failed to provide downstream chains adequate notice to upgrade before exploitation began.","timeline":[{"date":"2026-04-25","event":"Vulnerability (GHSA-7g4w-cg88-2cq2) reported via Cosmos Labs HackerOne bug bounty program.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-04-25","event":"Cosmos Labs assessed the bug as posing no risk to live production networks, citing the belief that only non-18-decimal chains were affected; issued via silent patch process.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-05-15","event":"Underflow fix merged to cosmos/evm main branch (PR #1176) as a silent patch with no public security advisory.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-05-20","event":"Balance snapshot fix merged (PR #1187); no coordinated disclosure to downstream chains.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-08-13","event":"Cosmos Labs confirmed internally that all Cosmos EVM chains, regardless of decimal configuration, were at risk from the vulnerability.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08-19","event":"Patched releases v0.6.2 and v0.7.2 published at 23:01 UTC with release notes that did not specify the security nature of the changes.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08-20","event":"Push Chain fork's public pull request (PR #40) published at 07:16 UTC, describing the vulnerability and exploitation path in detail — approximately 8 hours 15 minutes after patch release and more than 11 hours before the first confirmed attack.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08-20","event":"MANTRA chain attacked at 19:06 UTC; 720.9 million MANTRA tokens (~$3.6 million) drained from the network's burn address and a dormant multisig wallet. MANTRA monitoring did not flag the attack for nearly four hours.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"date":"2026-08-20","event":"MANTRA chain halted at approximately 7:13 p.m. ET; approximately 38 million MANTRA frozen in the attacker's wallet.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-21","event":"Cosmos Labs sent first private security notification email to known contacts at 03:36 UTC — approximately 8.5 hours after the first confirmed attack.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08-22","event":"TAC attacked at approximately 19:46 UTC; nearly 3 billion TAC tokens drained from a single account; approximately 1.2 billion TAC sold for ~$950,000.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-22","event":"KiiChain attacked at approximately 22:50 UTC; attacker repeated the exploit 18 times draining 148,326,583 KII before chain halted at block 9355723; approximately 64.6 million KII sold for ~$1.6 million.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-25","event":"Exploitation window closed; six chains confirmed affected with total losses of approximately $5.72 million.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"},{"date":"2026-08-26","event":"Blockchain analytics firm Bubblemaps identified Nesa as an additional affected chain; Nesa attacker reportedly profited approximately $60,000 and was funded via Monero.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-28","event":"Cosmos Labs published post-mortem acknowledging the April 2026 clearance was incorrect, describing two chained vulnerabilities, confirming centralized exchange accounts frozen, and identifying the lack of a complete downstream chain registry as a contributing factor.","source":"Cosmos Labs Post-Mortem","source_url":"https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md"}]},"v":1}