Cosmos Labs Discloses EVM Vulnerability Leading to Theft of Approximately $5.7 Million Across Six Chains
Cosmos Labs released an analysis of the EVM module security incident: From August 20, 19:06 to August 25, 15:20 (UTC), attackers exploited a shared Cosmos EVM vulnerability to steal funds from multiple chains. MANTRA was the first to report, and the security team distributed patches and mitigation guidance to about 40 chains through private channels.
Six networks were attacked. Based on prices on August 19, approximately $2.87 million in assets were sold on decentralized exchanges after being bridged, including about 2.6137 million USDT, 114.13 ETH, 93.78 TON, 1.39 USDC, and 98.87 OSMO; another approximately $2.85 million was sold on centralized exchanges, with related accounts frozen and under investigation. The total cash-out amounted to about $5.7 million. Additionally, 13 potential risk networks completed patches, halted chains, or implemented other protections in time, preventing further losses.
The flaw was reported through a bug bounty program on April 25. Testing failed to reproduce the issue on production network configurations, leading the team to believe it did not affect real funds, and they completed the fix without issuing a security announcement. The subsequent report identified the root cause as an unsigned integer underflow: balance checks wrapped around to a large value when insufficient, allowing unauthorized addresses to transfer funds when combined with calls like staking precompiles. Approximately 720.9 million tokens were moved from MANTRA, valued at about $3.6 million, primarily from burn addresses and genesis multi-signatures, with validator keys not compromised.
The official recommendation is for chains running the affected versions to immediately halt blocks and upgrade. Patch versions are indicated as v0.6.2 and v0.7.2. The lab stated it will strengthen key vulnerability triage and remediation, expand security communication coverage, and plans to introduce external experts to audit security practices. The shared module means that a misconfiguration in one chain can expose dozens of chains simultaneously.
The bounty was reported, but the announcement was not issued, leaving a window open until August. Networks that halted chains preserved their remaining inventory, while those that acted later bore the consequences of cashing out. Centralized exchanges froze accounts, temporarily sealing off some exits, while on-chain transactions that had already occurred could not be reversed.
In market mechanics, buyers are the counterparties in decentralized and centralized exchanges receiving stolen coins, while sellers are the application chains implicated by the shared module. The incident was triggered by production use. Funds flowed from burn addresses and treasury-like wallets to bridges and exchanges, then converted into stablecoins and mainstream assets. The beneficiaries were the 13 chains that halted blocks and patched in time, while the burden fell on the six chains that cashed out and the module maintainers who did not issue announcements.
Source: Public Information
ABAB AI Insight
The shared EVM module writes Cosmos application chains into the same set of account arithmetic. The April bounty was deemed "not reproducible in production," effectively replacing a full network configuration audit with a test matrix. Integer underflow is a textbook-level defect; once combined with staking precompiles, burn addresses can become transferable again. MANTRA's monitoring treated burn addresses as dead accounts, with the first transfer out having a nearly four-hour window. The coordination proof of forty chains shows that the security contact list for open-source modules is more critical than the code itself: chains without emails do not receive private patches.
The capital path involves module maintainers taking on triage, while application chains bear the burden of halting blocks and market value. The $3.6 million movement from MANTRA did not involve issuing new coins but merely reintroducing balances that should have been immovable into circulation. The $2.87 million after bridging and the $2.85 million on exchanges split the same inventory into two exits. Account freezes are the last gate of centralized clearing; decentralized transactions have no gate. The precompile double-spend in January Saga and this underflow are the second module-level incident on the same maintenance stack.
Similar structures are seen in Ethereum client vulnerabilities affecting multiple networks, cross-chain bridges sharing validators, and cloud images with the same misconfiguration. Application chains are at a stage of replacing Ethereum tool ecosystems with shared EVM while inheriting the radius of shared defects. Fixes without announcements equate to zero remediation for chains that have forked or delayed upgrades.
Essentially, this is a failure of security pricing in the reconstruction of the industrial chain. The mechanism is: module authors rate vulnerabilities using test environments, while application chains use mainnet funds for final acceptance; if the rating is too low, no announcement is made, and the absence of announcements allows attackers and maintainers to start simultaneously. Shared code dilutes development costs and also dilutes responsibility for production configurations.
ABAB News · Cognitive Law
Inability to reproduce in the test environment does not equate to safety of mainnet funds
The development costs saved by shared modules will be charged to forty chains on the same day
Fixes without announcements equate to no fixes for chains that have not upgraded