Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
Cosmos EVM flaw exploited after Cosmos Labs knew all blockchains running it were vulnerable.
A critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. Cosmos Labs knew about the vulnerability since April but initially misjudged its impact, only confirming its widespread risk by August 13. The fix was deployed via a silent patch process, which the company's own policy suggests should not have been used for a flaw of this severity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cosmos Labs?
Get an email when a new story names Cosmos Labs, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCosmos Labs identified a critical balance-handling vulnerability in the shared EVM module as early as April 2026 but initially underestimated its blast radius, failing to treat it with the urgency a cross-chain flaw demands. By the time the true scope was confirmed on August 13, attackers had a narrow but exploitable window before the patch reached all affected chains. Compounding the failure, the fix was distributed via a silent patch process that bypassed the company's own severity-based disclosure policy, leaving chain operators unaware of the criticality and unable to prioritize remediation. This incident illustrates how shared infrastructure vulnerabilities carry amplified risk — a single flaw in a common module can simultaneously compromise every ecosystem that inherits it. Transparent, severity-appropriate disclosure and coordinated patch deployment are non-negotiable when critical financial infrastructure is at stake.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.