Cosmos EVM Exploit Hit Six Chains: The Shared-Code Risk

A newly published Cosmos Labs post-mortem has turned a series of apparently separate blockchain incidents into one ecosystem-level security event. Between August 20 and August 25, attackers exploited the same critical vulnerability in Cosmos EVM across six networks. Cosmos Labs estimates that roughly $2.87 million in affected assets were converted through decentralized exchanges and another $2.85 million through centralized exchanges.

The important distinction is that Cosmos Hub itself was not “hacked,” nor was this an exploit of ATOM as a token. The vulnerable component was Cosmos EVM, shared software that enables Cosmos SDK-based chains to run Ethereum-compatible applications.

That makes the incident particularly relevant for Market Pulse. A chain can have its own validators, governance and applications yet still inherit risk from a common software dependency. For users moving assets between chains, the key question is therefore no longer only “Is this protocol safe?” but also “Which upstream components does this network depend on, and has it actually installed the latest security fix?”

What happened

Cosmos Labs published its full post-mortem on August 28 and classified the vulnerability as critical. Affected Cosmos EVM versions were releases below v0.6.2 and versions from v0.7.0 through v0.7.1. Patched versions are v0.6.2 and v0.7.2 or later.

The flaw involved inconsistent balance accounting between Cosmos EVM's StateDB and the Cosmos SDK bank module. Under specific conditions involving vesting balances and staking, an unchecked unsigned subtraction could underflow and wrap to an extremely large value. Attackers could then manipulate accounting in a way that allowed legitimate tokens to be extracted from affected accounts without a corresponding increase in total token supply.

Cosmos Labs says six networks were successfully exploited. Based on data provided by affected chains and public on-chain information, approximately $2.87 million was bridged away and exchanged on DEXs. Another estimated $2.85 million was deposited and sold through centralized exchanges. Cosmos Labs said accounts used by the attackers on centralized platforms had been frozen pending investigation. Those loss estimates have not been independently audited.

MANTRA provides one independently documented example. Its August 28 post-mortem says an attacker moved approximately 720.9 million MANTRA from a burn address and a legacy genesis-era multisig without compromising validator keys, admin keys or multisig signers. MANTRA valued the extracted tokens at roughly $3.6 million using its pre-incident spot price. The network halted on August 20 and resumed on August 22 after validators deployed a patched release.

Why the shared-code angle matters

Modern blockchains are not isolated software stacks.

Networks frequently reuse SDKs, execution environments, bridges, cryptographic libraries and precompiles. This improves development speed and interoperability, but it also concentrates technical risk. One defect in a widely deployed component can become an ecosystem-wide vulnerability.

The Cosmos incident demonstrates the difference between chain-specific risk and dependency risk.

A network's validator set may operate normally. Private keys may remain secure. Consensus itself may not be compromised. Yet a bug in a shared execution component can still affect balances.

That distinction matters when evaluating blockchain security. Validator count, TVL or audit history alone cannot reveal whether a network is running a vulnerable software release.

There is also a patch-distribution lesson. Cosmos Labs says the underlying issue had first been reported through its bug bounty program in April. The initial assessment incorrectly concluded that production networks were not at risk. A fix was later developed, and patched releases v0.6.2 and v0.7.2 were published on August 19, but the release notes did not publicly describe the exploit path because the team was following a silent-patch process.

MANTRA's account highlights the downstream problem: a security patch can exist while individual chains still need time to evaluate, test and coordinate a state-breaking upgrade across validators.

Security therefore depends on both code quality and patch latency.

Market reaction and liquidity risks

The direct dollar loss is only one part of a multi-chain exploit.

When a chain halts, users can lose access to deposits, withdrawals, bridges and DeFi positions even if their individual wallets were never compromised. During the MANTRA incident, all network transactions were frozen until the patched chain restarted.

That creates a liquidity problem.

If deposits or withdrawals are suspended on one venue while trading continues elsewhere, the same token can develop wider inter-exchange spreads. Arbitrageurs cannot efficiently move inventory between venues, so price differences can persist longer than under normal conditions.

Bridges are another key transmission channel. Cosmos Labs says part of the affected assets was moved to other networks before being exchanged. Once assets leave an exploited chain, incident response becomes a multi-platform problem involving bridges, DEX liquidity, centralized exchanges and potentially law enforcement.

For MyCoinWay users, this means a security incident should not be evaluated only through the token's percentage price move. Deposit status, withdrawal status, bridge availability and abrupt changes in exchange spreads may offer a clearer picture of immediate market stress.

A patch does not instantly remove ecosystem risk

The vulnerable code now has public patched versions, but that does not automatically mean every downstream network is safe.

The practical question is whether each chain has upgraded.

Cosmos Labs said it coordinated with around 40 Cosmos chains while responding to the exploit. That is why version adoption matters more than the existence of a patch on GitHub.

Users should also be careful with token transfers immediately after a restart. A functioning block explorer does not necessarily mean every bridge, exchange or RPC endpoint has resumed normal service.

The same principle applies to liquidity: a chain may be technically operational while exchange deposits remain disabled or market makers maintain smaller inventories.

What to watch next

• Cosmos EVM version adoption: affected chains should be running v0.6.2, v0.7.2 or later rather than vulnerable releases.
• Deposits, withdrawals and bridges: restored block production does not guarantee that every transfer route has reopened.
• Inter-exchange spreads and volume spikes: widening gaps can signal fragmented liquidity while arbitrage channels remain impaired.
• Recovery of stolen assets: watch confirmed statements on frozen CEX accounts and recovered funds rather than speculative wallet attribution.
• Further security disclosures: the most important systemic question is whether related accounting assumptions or downstream forks contain similar flaws.

For Market Pulse, the practical signal is straightforward: after a shared-infrastructure exploit, monitor transferability and liquidity, not price alone.

Disclaimer

This article is for informational and analytical purposes only. It does not constitute investment, legal or tax advice, a recommendation to buy or sell any cryptoasset, or a forecast of future returns. Blockchain networks involve software, bridge, validator, liquidity, custody and operational risks. Users should verify the current status of a network and the services they use before transferring assets.

Sources

Cosmos Labs — August 28 Cosmos EVM security post-mortem. Official post-mortem

Cosmos EVM — critical security advisory and affected versions. GitHub Security Advisory

MANTRA — August 20 incident post-mortem. MANTRA post-mortem

The Block — independent reporting on the six-chain exploit. The Block report

The Hacker News — independent technical coverage. The Hacker News analysis