Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

A critical balance-handling flaw in the Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and 25, 2026. The vulnerability, initially missed due to a misunderstanding of how the system handled vesting accounts, allowed attackers to steal approximately $5.72 million in assets. Despite Cosmos Labs’ awareness of the issue and subsequent release of patches, the vulnerability was not proactively distributed privately to affected networks, leading to a prolonged exploitation period. The incident highlighted a gap in Cosmos Labs’ security practices, particularly regarding the lack of proactive private patch distribution and a limited registry of Cosmos EVM deployments.