Cosmos Labs said a critical balance-handling flaw in its Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The bug, tracked as GHSA-7g4w-cg88-2cq2, affected all Cosmos EVM chains and had fixes ready in v0.6.2 and v0.7.2 on August 19.
The flaw sat in the handoff between the EVM side and the Cosmos bank module. The code only tracked spendable balance, then underflowed when a delegated amount was written back, so reconciliation could treat locked money as available and wrap the balance to an enormous value. That is why the fix is not a routine node update: it changes state assumptions across the network and needs a coordinated upgrade, or a chain halt, to land safely.
For operators, the exposure is not just the vulnerable code but the shared chain state they all inherit; if one chain delays or improvises, the inconsistency can outlive the patch window. Cosmos Labs also said its earlier review missed the live-network impact, so the reporting still leaves a coordination problem, not a simple software problem.