Cosmos Cleared This Bug in April. The Public Fix Showed Attackers How to Drain 6 Chains

What Happened

On August 28, Cosmos Labs published a post-mortem and a critical security advisory for Cosmos EVM, the shared module that lets blockchains built on the Cosmos stack run Ethereum Virtual Machine (EVM) smart contracts. Between August 20 and August 25, attackers used a balance-accounting bug in that module to drain 6 networks, including MANTRA, TAC, and KiiChain, converting roughly $5.

7 million: about $2.87 million through decentralized exchanges and an estimated $2.85 million through centralized venues, figures the post-mortem presents as estimates at August 19 prices, not independently audited. MANTRA alone lost 720.9 million MANTRA tokens, then worth about $3.

6 million, pulled from 2 addresses no outsider should have been able to touch: the network's burn address and a dormant multisig wallet left over from an earlier incentive campaign.

The post-mortem's real disclosure is the timeline. A researcher reported the bug through the Cosmos bug bounty program on April 25. Cosmos Labs tested it, concluded it posed no risk to funds on live networks, and merged a fix into the public codebase on May 15 under its silent patch process, which ships fixes without telling chain operators what they address.

In early August, reports from independent researchers established that the conclusion was wrong, and by August 13 Cosmos Labs had confirmed that all Cosmos EVM chains were affected regardless of configuration. Patched releases went out on August 20. About 8 hours later, a public pull request describing the vulnerability and its exploitation path was published.

The first attack on MANTRA began roughly 11 hours after that.

The bug bounty worked. The triage and the sequencing did not, and 6 chains paid for a patch that told attackers exactly where to strike.

The Assessment Tested the Wrong Configuration

The April triage failed on a detail. Per the post-mortem, engineers concluded the flaw was exploitable on networks using 6-decimal token precision, while known production Cosmos EVM chains ran 18 decimals, so deployed networks were judged safe. The bug itself sat in the StateDB, the accounting layer that tracks balances while contracts execute.

That layer tracked only spendable balances and ignored amounts locked in vesting accounts. When a vesting account delegated more than its spendable balance, the write-back subtracted the full delegated amount from the smaller spendable figure, and the unchecked arithmetic wrapped the balance to a number near 2 to the 256th power.

A mechanism that exists to lock tokens (vesting) combined with a mechanism that exists to secure the network (staking delegation) produced the largest balance the ledger can represent, credited to the attacker by the accounting system itself.

This is the 2nd time in 8 months the same module has burned a production network. On January 21, an attacker drained roughly $7 million from Saga's EVM network using forged Inter-Blockchain Communication (IBC) messages, a different bug in the same codebase, patched in v0.6.0 in March.

The module is a monoculture: during the August response, Cosmos Labs says it coordinated with about 40 networks, and 13 exposed chains patched, halted, or deployed mitigations before attackers reached them. A bug bounty is supposed to be the pipeline that converts one researcher's find into protection for everyone downstream.

In April the pipeline received exactly the input it was built for, and the triage step dismissed it.

The Patch Became the Roadmap

Once the severity was confirmed, the sequencing did the rest of the damage. Sophisticated attackers watch the commit histories and release notes of major open-source projects precisely because a fix is a map: the diff shows what was broken, and the window between a public patch and a fleet-wide upgrade is the attack window.

Security researchers call the technique patch-gapping. Here the map came with a legend, because the public pull request that followed the August 20 releases described the vulnerability and its exploitation path directly. Chains that could not complete a coordinated upgrade within hours were racing adversaries who had been handed the target.

Several networks, including MANTRA and KiiChain, halted their validators mid-crisis to stop the bleeding, and KiiChain publicly called the handling irresponsible, saying the incident could have been avoided.

The defensible version of each decision deserves stating, because none of this was malicious. Quietly fixing a bug judged unexploitable is standard practice across open-source software, patches to a public repository are public by nature, and once the true severity was confirmed, Cosmos Labs coordinated with dozens of networks and demonstrably saved 13 of them.

The failure was not secrecy and not openness: it was sequencing. Operators of live networks holding user funds were not privately warned and given time to upgrade before the exploit path was described in public. The post-mortem concedes the April assessment wrongly cleared the bug, and in shared infrastructure, that concession is the structural lesson: disclosure order is a security boundary, and it failed here.

What This Means for You

If you hold assets on any Cosmos EVM chain, the immediate check is concrete: confirm your chain has upgraded to v0.6.2 or v0.7.2 or later. The advisory is explicit that no configuration-only mitigation exists and that halting is preferable to workarounds, which means an unpatched chain is either exposed or frozen.

A halt protects the ledger, but it also freezes your ability to transact or exit, and that timing risk is part of what you hold when you hold an app-chain asset.

The portfolio-level lesson is about inheritance. An asset on an app-chain inherits its entire upstream supply chain: the shared module's triage judgment, its silent patch policy, its disclosure sequencing, and the operational discipline of every maintainer in between. None of that appears on a price chart, and most of it is invisible until a week like this one.

Before trusting a chain or protocol with meaningful value, check 3 things: whether it publishes security advisories in a known location, whether it runs an active bug bounty, and whether it has a stated coordinated-disclosure policy with the operators who run its code. Based on the documented pattern in this series, projects that fail those checks are publishing their risk posture in advance.

The sovereignty contrast is the sizing tool. Native Bitcoin held in self-custody, with private keys generated and stored on your own hardware wallet, does not depend on a module vendor's triage call, a silent patch policy, or an 11-hour disclosure race; its exposure is to one battle-tested codebase with one of the slowest, most conservative change processes in the industry.

That is not a claim of perfection, it is a claim about surface area. Assets living on fast-shipping shared modules carry a dependency on maintainers you have never audited, which behaves like custodial risk even when you hold the keys. Size what you keep there accordingly.

What to Watch

Watch whether Cosmos Labs changes the silent patch process or adopts a formal operator-notification window, because that is the reform this incident actually argues for. Watch whether the 3 unnamed victim chains are identified, whether the $5.7 million estimate survives an independent audit, and whether stolen funds move toward mixers or toward freezeable stablecoin rails where issuers and law enforcement can reach them.

Watch whether MANTRA restores the drained burn-address tokens through a state change, which would itself be a governance precedent worth noting. And watch whether affected chains start diversifying off the shared module, because 2 exploits in 8 months is the kind of record that reprices a monoculture.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.