A pull request explained the Cosmos EVM bug at 07:16, and the first chain was drained by 19:06

At 07:16 UTC on Thursday 20 August 2026, a developer at Push Chain opened pull request number 40 against Push Chain’s fork of Cosmos EVM. It described a vulnerability in the shared codebase and how to exploit it, attributed the finding to a Hacken audit, and listed which released tags were still vulnerable.

At 19:06 UTC the same day, eleven hours and fifty minutes later, the first chain was attacked. By 25 August six had been.

Cosmos Labs published its advisory and post-mortem on 28 August. The account below is drawn from that document, from the repository itself, and from block times we read off each chain’s own nodes this morning.

The arithmetic

Cosmos EVM’s StateDB tracks only an account’s spendable balance. Vesting accounts in Cosmos SDK state have two: a spendable balance and a locked one. The x/staking module and the EVM’s staking precompile both let a vesting account delegate the locked balance as well.

So when such an account delegates more than it can spend, the write-back subtracts more than the StateDB thinks is there, and an unchecked underflow in SubBalance wraps the balance to about 2 to the power of 256.

The second half turns that into money. The attacker sent the wrapped balance to a victim account holding a large balance of its own, typically the 0x00 address or a multisignature wallet created at genesis. Cosmos Labs describes the result:

The result of sending the 2^256 - balance(victim) tokens was an overflow that netted out such that the attacker was left with the victim’s balance and the victim account was left with 0 tokens.

Total supply never changed, which is why nothing tripped a supply alarm.

The clever part is getting a contract into a vesting account at all, since an ordinary wallet cannot over-delegate. The attacker precomputed the deterministic address its exploit contract would deploy to, made that address a vesting account first, and then deployed the contract onto it. The contract inherited the vesting status, and both halves fired inside one supply-neutral transaction.

Why the fix went out in the open

The bug arrived through the Cosmos bug bounty on 25 April 2026, with a proof of concept for a network using six decimals. Cosmos Labs could not reproduce it elsewhere, and its post-mortem says so without hedging:

We were unable to reproduce the vulnerability on 18-decimal networks and incorrectly concluded that it affected only non-18-decimal networks.

Every known production Cosmos EVM network uses eighteen decimals. On that reading the bug threatened nobody, so it was handled under the silent patch process, which is the documented route for issues that do not cause fund loss on live chains: fix it on the public main branch, say nothing, and let it ride into the next release. The patch was merged in May and not backported, because it was state-breaking and would have forced a coordinated upgrade.

In early August, further reports from independent researchers let the team reproduce the bug across configurations and confirm that every Cosmos EVM chain was affected. At that point the usual route for a fund-threatening flaw is a private patch distributed through secure channels. The post-mortem explains why that did not happen: the fix had already been sitting in public on main without any known exploitation, so the team concluded the silent process was still safe. On 19 August at 23:01 UTC the patch was “obfuscated and backported” into v0.6.2 and v0.7.2, with release notes that mention security without describing urgency or severity.

Silent patching rests on one assumption, which Cosmos Labs states in its own report: that the security significance of a patch, and the method of exploiting the bug behind it, are not readily identifiable even though the code is public. Push Chain’s pull request removed that assumption in a morning. Cosmos Labs’ response is pointed:

The publication of a vulnerability and exploit path in public by a downstream developer is highly unusual and can increase the risk of an exploit.

It adds a figure: “Cosmos Labs has released patches for 37 vulnerabilities silently in the last 13 months without downstream developers precisely describing exploit paths in public.”

What happened to each chain

MANTRA was hit twice on 20 August, at 19:06 and 22:59 UTC, and stopped. Its last block before the halt is 17,449,399, timestamped 23:13:04 UTC, and its first block afterwards is 17,449,400 at 03:38:07 UTC on 22 August: a gap of 28 hours and 25 minutes, read from the chain’s own block times. Its status page puts the resumption at “approximately 05:30 UTC / 13:30 HKT on 22 August”, about two hours later than the chain says itself. The same page, updated on 24 August, said a post-mortem report would be released in the days that followed. None has appeared on any MANTRA channel we can find.

TAC was attacked at 19:46:37 UTC on 22 August, at height 24,662,148. Cosmos Labs records 2,985,651,403.40 TAC leaving the bonded tokens pool and being bridged to BNB Chain within the minute, where about 1.2085 billion of it was swapped for 950,293 USDT across roughly 80 transactions. TAC halted at block 24,671,475 at 23:58:11 UTC. That is still the chain tip. We checked it this morning against TAC’s own explorer API and an independent public RPC node, and both return the same height and the same timestamp from 22 August.

KiiChain lost 148,326,583.15 KII across eighteen repeats of the same technique, halted after block 9,355,724 at 22:51:00 UTC on 22 August, and resumed at 20:24:08 UTC on 27 August, four days and 21 hours later. It is producing blocks normally now.

Two of those block numbers differ by one from the reports. KiiChain’s own account says the halt was “at block 9355723 (22:50:58 UTC)” and Cosmos Labs puts MANTRA’s at 17,449,398. Both are the last block each team saw before pulling the switch; the chains then produced one more apiece, at 22:51:00 and 23:13:04 UTC, and stopped there. We have used the number the chain itself reports.

BounceBit is a separate incident with a different flaw, and it came first: its final block, 20,702,857, is timestamped 02:36:37 UTC on 20 August, and there has been no block since. Its operator says it will retire the Layer 1 and reissue BB as a BEP-20 token on BNB Chain rather than upgrade.

Cosmos Labs names only MANTRA, TAC and KiiChain, and points readers to “the individual teams’ post-mortems” for the other three. It names no team and links no report, and we could not find one.

The two accounts do not agree

KiiChain published its own report on 24 August, and it is the sharpest document in the set. On where the fault lies it is unambiguous: “The vulnerability is in Cosmos code, not KiiChain code. It sits in the shared Cosmos EVM module (cosmos/evm), which KiiChain runs unmodified.”

On the disclosure it is harder still:

This loss was avoidable. Cosmos Labs published a fix for one of the three defects in a public repository on Wednesday 19 August 2026. Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit.

KiiChain’s case is about sequencing rather than code. It says a patch takes days to review, build, test and roll out across a validator set, and a halt takes minutes, so the halt instruction was the only measure that could have contained the risk immediately. Cosmos Labs sent its first notification at 03:36 UTC on 21 August and recommended halting at 23:45 UTC on 22 August, by which point MANTRA, TAC and KiiChain had all been hit.

The two documents also disagree about the bug itself. Cosmos Labs describes two chained vulnerabilities, both closed by v0.6.2 and v0.7.2. KiiChain counts three, and says: “Two of the three defects are still unfixed upstream at Cosmos Labs. Only the underflow has been patched publicly. Any Cosmos EVM chain with vesting accounts enabled that has applied the official upstream fix alone remains exposed to the other two.”

Both are primary documents from parties with direct knowledge, and nothing we opened resolves the difference. If KiiChain is right, chains that patched and moved on have not finished.

Nobody knows how many chains run this

Cosmos Labs is candid about the shape of the problem. The ecosystem spans more than 115 known public blockchains, the software is permissionless to deploy, and there is no complete registry of who is running it. During the response the team coordinated with 40 chains, worked with thirteen other exposed networks that patched or halted, and found eleven Cosmos EVM deployments that had never registered with its security channels at all.

The repository’s own README names Ondo, Mezo, Mantra, the XRP sidechain, TAC and Stable “and others”. That list, plus a mailing list nobody is obliged to join, is the whole of the distribution record.

The bug has no number

For a flaw that stopped three chains and emptied three more, the paperwork is thin. GHSA-7g4w-cg88-2cq2 carries no CVE, no CWE and no CVSS score. We queried the OSV database this morning: a direct lookup returns 404, and a package query for github.com/cosmos/evm returns the three earlier cosmos/evm advisories, each with a GO- identifier attached. This one has none, so a dependency scan of a Go project will not surface it.

The bug class is older than Cosmos EVM. The Push Chain pull request names Evmos advisory GHSA-pxv8-qhrh-jc7v, “Transferring unvested tokens after delegations”, as the same family. That advisory was published on 6 June 2024, carries CVE-2024-32873, and is rated Low with a CVSS score of 3.5.

Cosmos EVM is a fork of evmOS, and its own README records how it got there: the Interchain Foundation funded the evmOS developers, “Tharsis to open-source the original evmOS codebase”. Evmos itself is gone. Its own governance shut the chain down in May 2026, at around block 37,318,000.

The Cosmos chain-registry now records the chain’s status as killed, a change merged on 3 June 2026.

Its website has gone too. evmos.org today serves a Namecheap parking page whose heading reads “Domain registration has expired.”

The code outlived the project, and so did the bug class.

Cosmos Labs closes its report with one sentence doing two jobs at once: “This report is provided for informational purposes only and does not constitute an admission of liability.”