cosmoscritical
Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
A critical vulnerability in the Cosmos EVM module allowed attackers to drain funds from six blockchains between August 20-25, 2026. The flaw, related to balance handling in vesting accounts, was known to Cosmos Labs but initially underestimated. Despite patches being released on August 19, the exploit was successful due to a delayed and improperly handled disclosure and patching process, leading to an estimated loss of nearly $5.7 million.