Top Highlights
-
A critical Cosmos EVM balance flaw was exploited on six blockchains from August 20–25, enabling attackers to manipulate vesting-account balances.
-
Estimated assets sold totaled about $5.72 million; figures are based on chain reports and public exchange data, and are not independently verified.
-
Cosmos Labs misjudged the bug’s reach, then used a public silent-patch process despite confirming all Cosmos EVM chains were vulnerable—leaving a gap before operators were privately notified.
- Operators should upgrade to v0.6.2, v0.7.2, or later via coordinated network upgrade; chains unable to upgrade should halt, and forks must verify all affected code paths are patched.
A shared flaw put multiple networks at risk
A critical flaw in Cosmos EVM software helped attackers take funds from six blockchains between August 20 and 25, Cosmos Labs says. The company confirmed on August 13 that every chain running Cosmos EVM faced the risk, regardless of how it handled token decimals.
The flaw affected how software reconciled account balances. In some cases, it could turn a balance calculation into an enormous value, allowing attackers to move funds or destroy a victim’s recorded balance. The issue required chains to allow users to create vesting accounts, which can hold both spendable and locked funds.
Cosmos Labs received a bug report on April 25. At first, the team believed the flaw affected only networks with certain balance settings. It corrected that assessment in August, but used its public “silent patch” process instead of privately sharing the fix with affected chains. The company’s policy calls for private fixes or emergency steps when a flaw threatens funds across networks.
Operators face a coordinated upgrade
Cosmos Labs released fixes on August 19. The first public description of the exploit appeared in a blockchain project’s code repository the next day. The first reported attack began nearly 12 hours later, against MANTRA. Cosmos Labs sent its first private warning to network operators after MANTRA reported the attack.
The company says attackers sold about $2.87 million in affected assets on decentralized exchanges, based on prices from August 19. It estimates another $2.85 million in sales on centralized exchanges. Neither figure has been independently audited.
Operators must upgrade to version 0.6.2, 0.7.2, or a later release through a coordinated network upgrade. If they cannot upgrade promptly, Cosmos Labs advises them to halt their chains. The flaw has no configuration-only fix. Operators should also check that their own code includes the necessary changes, since some networks use customized versions of the software.
Shared software helps blockchain teams launch networks without building every component from scratch. However, one defect in widely reused code can put many networks at risk. Cosmos spans more than 115 known public blockchains, and Cosmos Labs says it does not have a complete registry of networks using its tools. Better security contacts and clearer upgrade procedures could help operators respond faster as blockchain systems become part of everyday financial infrastructure.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
CyberAttacks-V1
