April

Security

MANTRA

Cosmos

when

<p>Cosmos Labs says a critical Cosmos EVM vulnerability reported through its bug bounty programme in April was incorrectly judged not to affect production networks. Attackers exploited the vulnerability across six chains between August 20 and August 25, 2026.</p>
<p>The activity moved about $2.87 million through decentralised exchanges and another $2.85 million through centralised exchanges, according to the <a href="https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md" rel="noopener noreferrer nofollow">Cosmos Security post-mortem</a>.</p>
<p>The incident exposed a months-long gap between the initial report and releases reaching affected branches shortly before the first known attack. Cosmos Labs said it used its silent patch process because early testing found production chains were safe; the releases did not include a vulnerability-specific advisory.</p>
<h2 id="april-report-was-cleared-after-production-testing">April report was cleared after production testing</h2>
<p>Cosmos Labs’ bug bounty programme received the flaw on April 25. The company said its testers initially concluded that production networks were not vulnerable; the exploit’s use in August later disproved that assessment.</p>
<p>The later post-mortem called the issue a critical balance-underflow vulnerability in <a href="https://cryptodaily.co.uk/glossary/exploring-the-ethereum-virtual-machine-what-you-need-to-know" rel="noopener noreferrer nofollow">Cosmos EVM</a>, the Ethereum-compatible stack used by the affected networks. Because the production networks were judged safe, Cosmos Labs handled the remediation through a silent patch process instead of issuing a vulnerability-specific advisory.</p>
<p>A patch could therefore be available without operators knowing that it addressed an urgent security exposure, and no vulnerability-specific public warning was given before the attacks began.</p>
<h2 id="unchecked-statedb-subtraction-created-unauthorised-balances">Unchecked StateDB subtraction created unauthorised balances</h2>
<p>The underlying defect sat in Cosmos EVM’s StateDB, according to the project’s <a href="https://github.com/cosmos/evm/security/advisories/GHSA-7g4w-cg88-2cq2" rel="noopener noreferrer nofollow">security advisory</a>. An unchecked subtraction could occur when a vesting account delegated more than its spendable balance.</p>
<p>Instead of failing safely, the account balance wrapped to approximately 2256. That enormous resulting balance enabled attackers to transfer funds from accounts that had not authorised those transactions.</p>
<p>The exploit mechanism did not depend on an attacker obtaining administrative access. It arose from the balance-handling error itself, which is why the speed and clarity of the software upgrade became central after the fix was made available.</p>
<h2 id="backported-releases-arrived-hours-before-the-first-attack">Backported releases arrived hours before the first attack</h2>
<p>Cosmos EVM’s main branch received the fix on May 15, but it was not backported to the v0.6.x and v0.7.x release branches until August 19. Versions v0.6.2 and v0.7.2 were published at 23:01 UTC, roughly 20 hours before the first known attack, according to <a href="https://mantrachain.io/resources/announcements/20th-august-2026-full-incident-post-mortem" rel="noopener noreferrer nofollow">MANTRA Chain’s incident post-mortem</a>.</p>
<p>MANTRA said that window was not realistic for organising a state-breaking upgrade across its validator set, which requires coordination among network operators rather than a routine update by a single company. <a href="https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061" rel="noopener noreferrer nofollow">The Block reported</a> that the patched releases did not identify the vulnerability, corroborating MANTRA’s account of the narrow response window.</p>
<p>The main-branch fix had therefore existed for months before the relevant release-branch versions were published.</p>
<h2 id="six-chain-exploitation-moved-roughly-5-7-million-through-exchanges">Six-chain exploitation moved roughly $5.7 million through exchanges</h2>
<p>Across the six exploited networks, Cosmos Labs estimated that roughly $5.72 million was exchanged: approximately $2.87 million via <a href="https://cryptodaily.co.uk/glossary/leading-decentralized-exchanges-the-future-of-crypto-trading" rel="noopener noreferrer nofollow">decentralised exchanges</a> and $2.85 million through centralised venues. Those figures describe exchange flows identified in the Cosmos Labs post-mortem, rather than a complete chain-by-chain accounting of losses.</p>
<p>MANTRA reported a separate token-loss figure of 720,923,967.99 MANTRA, valued at about $3.6 million at the pre-incident price. The chain said no validator keys, administrator keys, governance controls or multisig signers were compromised.</p>
<p>The combined record points to a software vulnerability that was reported in April, cleared after testing, and only patched in the affected release lines shortly before exploitation began. For the operators running those chains, the relevant upgrade window was measured in hours.</p>
<p>Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.</p>

Cosmos EVM Bug Behind $5.7M Six-Chain Hack Was Cleared Too Early

Table of Contents

Crypto Daily™

Other articles published on Aug 30, 2026

Join our free newsletter for daily crypto updates!