Full Report
Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score. Affected versions are =
Analysis Summary
# Incident Report: Critical Balance-Handling Flaw in Cosmos EVM Module
## Executive Summary
A critical vulnerability in the shared Cosmos EVM module, designated GHSA-7g4w-cg88-2cq2, was exploited to drain funds from six distinct blockchains. The flaw stemmed from an unchecked integer subtraction during the reconciliation of EVM state and the Cosmos SDK `x/bank` module, allowing attackers to wrap account balances to near-infinite values. Despite being reported via bug bounty in April 2026, a miscalculation of the risk led to a delayed and public "silent patch" process that was ultimately front-run by attackers.
## Incident Details
- **Discovery Date:** August 13, 2026 (Confirmed impact on all chains); August 28, 2026 (Post-mortem)
- **Incident Date:** August 20 – August 25, 2026
- **Affected Organization:** Six unnamed blockchains utilizing the Cosmos EVM module
- **Sector:** Blockchain / Decentralized Finance (DeFi)
- **Geography:** Global / Distributed
## Timeline of Events
### Initial Access
- **Date/Time:** August 20, 2026
- **Vector:** Exploitation of logic flaw in balance reconciliation.
- **Details:** Attackers targeted chains that allowed permissionless creation of vesting accounts. By delegating more than the spendable balance, they triggered an unchecked subtraction.
### Lateral Movement
- **N/A:** The attack was a direct exploit of smart contract/protocol logic rather than traditional network lateral movement. Attackers moved funds across integrated modules (EVM to `x/bank`).
### Data Exfiltration/Impact
- **August 20–25, 2026:** Funds were successfully drained from six blockchains. On 0.6.x chains, the exploit caused supply overflows that halted block production; on 0.7.x chains, attackers successfully manipulated balances to extract value or "burn" victim holdings.
### Detection & Response
- **April 25, 2026:** Initial bug bounty report received; Cosmos Labs incorrectly concluded live networks were not at risk.
- **August 13, 2026:** Cosmos Labs confirmed all EVM chains were vulnerable regardless of decimal configuration.
- **August 19, 2026:** Patches (v0.6.2 and v0.7.2) released via a public "silent patch" process.
- **August 28, 2026:** Public post-mortem published following the exploitation of the public patch.
## Attack Methodology
- **Initial Access:** Exploitation of `GHSA-7g4w-cg88-2cq2` via the `MsgCreateVestingAccount` path.
- **Persistence:** Not applicable; transaction-based exploitation.
- **Privilege Escalation:** Logic exploit to gain "infinite" minting authority by wrapping `uint256` balances.
- **Defense Evasion:** Use of precomputed contract addresses and single-transaction execution to keep net supply changes at zero (avoiding some automated alarms).
- **Discovery:** Identification of chains permitting permissionless vesting-account creation.
- **Impact:** Unchecked integer subtraction in the reconciliation between EVM `StateDB` and SDK `x/bank` allowed for balance wrapping to ~2^256.
## Impact Assessment
- **Financial:** Funds drained from six blockchains (total amount not disclosed).
- **Data Breach:** None (integrity and availability breach rather than confidentiality).
- **Operational:** Several chains experienced supply overflows and were forced to halt block production.
- **Reputational:** High; Cosmos Labs faced criticism for failing to follow its own emergency mitigation policies despite knowing user funds were at risk.
## Indicators of Compromise
- **Behavioral indicators:**
- Unexpected calls to `MsgCreateVestingAccount`, `MsgCreatePermanentLockedAccount`, or `MsgCreatePeriodicVestingAccount`.
- Anomalous delegation transactions exceeding spendable balances.
- Contract deployments to precomputed addresses followed immediately by high-value transfers.
## Response Actions
- **Containment:** Recommended halting of affected chains if upgrades could not be performed immediately.
- **Eradication:** Release of versions v0.6.2 and v0.7.2 to fix the unchecked subtraction logic.
- **Recovery:** Coordinated network upgrades (state-breaking) were required to apply the fix and reconcile balances.
## Lessons Learned
- **Risk Assessment Errors:** The initial assessment failed to reproduce the bug on 18-decimal networks, leading to a false sense of security for four months.
- **Policy Failure:** The "silent patch" process was used for a critical vulnerability that threatened user funds, contradicting the established security policy for private distribution.
- **Verification Gaps:** Cherry-picked patches in some instances left unexported duplicate code vulnerable, highlighting the need for comprehensive code audits during patching.
## Recommendations
- **Immediate:** All Cosmos EVM operators must upgrade to v0.7.2/v0.6.2 or later.
- **Short-term:** Disable permissionless vesting account creation in the ante handler (`MsgCreateVestingAccount`).
- **Policy:** Revise the vulnerability reproduction protocol to ensure testing covers all possible environmental configurations (e.g., various decimal settings).
- **Process:** Adhere strictly to private disclosure/patching channels for vulnerabilities confirmed to impact production funds.