Cosmos Labs released an analysis of the EVM module security incident: From August 20, 19:06 to August 25, 15:20 (UTC), attackers exploited a shared Cosmos EVM vulnerability to steal funds from multiple chains. MANTRA was the first to report, and the security team distributed patches and mitigation guidance to about 40 chains through private channels.

Six networks were attacked. Based on prices on August 19, approximately $2.87 million in assets were sold on decentralized exchanges after being bridged, including about 2.6137 million USDT, 114.13 ETH, 93.78 TON, 1.39 USDC, and 98.87 OSMO; another approximately $2.85 million was sold on centralized exchanges, with related accounts frozen and under investigation. The total cash-out amounted to about $5.7 million. Additionally, 13 potential risk networks completed patches, halted chains, or implemented other protections in time, preventing further losses.

The flaw was reported through a bug bounty program on April 25. Testing failed to reproduce the issue on production network configurations, leading the team to believe it did not affect real funds, and they completed the fix without issuing a security announcement. The subsequent report identified the root cause as an unsigned integer underflow: balance checks wrapped around to a large value when insufficient, allowing unauthorized addresses to transfer funds when combined with calls like staking precompiles. Approximately 720.9 million tokens were moved from MANTRA, valued at about $3.6 million, primarily from burn addresses and genesis multi-signatures, with validator keys not compromised.

The official recommendation is for chains running the affected versions to immediately halt blocks and upgrade. Patch versions are indicated as v0.6.2 and v0.7.2. The lab stated it will strengthen key vulnerability triage and remediation, expand security communication coverage, and plans to introduce external experts to audit security practices. The shared module means that a misconfiguration in one chain can expose dozens of chains simultaneously.

The bounty was reported, but the announcement was not issued, leaving a window open until August. Networks that halted chains preserved their remaining inventory, while those that acted later bore the consequences of cashing out. Centralized exchanges froze accounts, temporarily sealing off some exits, while on-chain transactions that had already occurred could not be reversed.

In market mechanics, buyers are the counterparties in decentralized and centralized exchanges receiving stolen coins, while sellers are the application chains implicated by the shared module. The incident was triggered by production use. Funds flowed from burn addresses and treasury-like wallets to bridges and exchanges, then converted into stablecoins and mainstream assets. The beneficiaries were the 13 chains that halted blocks and patched in time, while the burden fell on the six chains that cashed out and the module maintainers who did not issue announcements.

Source: Public Information