Cosmos EVM Balance Flaw Exploited After Failed Patch Attempt

A critical balance-handling vulnerability in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The flaw, identified as GHSA-7g4w-cg88-2cq2, allowed attackers to manipulate account balances to mint funds or burn the holdings of other users.

The vulnerability affected Cosmos EVM versions prior to 0.6.2 and versions between 0.7.0 and 0.7.2. Technically, the flaw resided in the reconciliation code between the EVM StateDB and the Cosmos SDK x/bank module. Specifically, an unchecked underflow occurred during the StateDB SubBalance write-back process when a vesting account delegated more than its spendable balance. This caused the account balance to wrap to approximately 2^256, granting the attacker effectively infinite funds.

The Failure of Disclosure

The vulnerability was originally reported to Cosmos Labs via the project's bug bounty program by researcher @AshmitSh4rma. Despite this early warning, the flaw remained active in production environments for months. Cosmos Labs attempted to address the issue with a "silent patch" released on August 19, just one day before the exploits began. However, this patch failed to prevent the subsequent attacks, which targeted six different blockchains over a five-day window.

Industry Implications

This incident underscores the systemic risks associated with "silent patches" in critical blockchain infrastructure. By opting for a quiet update rather than a coordinated private disclosure to downstream developers, Cosmos Labs left multiple networks exposed without the necessary urgency to upgrade. The event highlights a significant breakdown in vulnerability management, as the core development team was aware of the risk but failed to ensure the security of the ecosystem's production networks.

Path to Remediation

To resolve the issue, networks must upgrade to the patched versions of the Cosmos EVM. Some contributors, such as those on the Warden Protocol, have noted that removing the ability for users to create vesting accounts can close the precondition required for the exploit. Security auditors and developers are now scrutinizing the reconciliation logic between EVM states and SDK modules to ensure similar underflow errors are not present in other shared components.