Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Summary: Cosmos Labs disclosed that a critical balance-handling flaw in the shared Cosmos EVM module, tracked as GHSA-7g4w-cg88-2cq2, was exploited to drain funds from six blockchains between August 20 and August 25, 2026, after the company confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration. The flaw was reported through the bug bounty program on April 25 and assessed as posing no risk to live funds, and the fix shipped in v0.6.2 and v0.7.2 on August 19 through the company's public silent patch process rather than private distribution.
What you should know: Attackers sold approximately USD 2.87 million in affected assets on decentralised exchanges and a further USD 2.85 million on centralised exchanges, while Cosmos Labs said it holds no complete registry of the networks running its software across an ecosystem spanning over 115 known public blockchains.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026