Critical Cosmos EVM Flaw Exploited: Funds Drained from Six Blockchains
- Severity
- CRITICAL
- Affected component
- cosmos-evm (npm)
- Patched version
- Not yet available
An early warning has been issued regarding a critical balance-handling flaw in the Cosmos EVM module. This vulnerability, designated GHSA-7g4w-cg88-2cq2, was reportedly exploited to drain funds from six blockchains between August 20 and August 25, 2026.
What happened
Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains. The vulnerability, designated GHSA-7g4w-cg88-2cq2, was exploited between August 20 and August 25, 2026. Cosmos Labs initially assessed the flaw as posing no risk to funds on live networks but confirmed by August 13 that all Cosmos EVM chains were affected regardless of decimal configuration.
The flaw was reported through Cosmos Labs' bug bounty program on April 25, 2026. The fix was shipped in versions 0.6.2 and 0.7.2 on August 19, 2026. Chain operators are advised to upgrade to one of these releases or later, as the change is state-breaking and requires a coordinated network upgrade. Operators who cannot upgrade immediately are advised to halt the chain rather than attempt a coordinated governance upgrade.
What to do about it
- Upgrade to the latest version of cosmos-evm.
- Monitor for any suspicious activity in affected environments.
- If immediate upgrade is not possible, halt the chain to prevent further exploitation.
How 0Day would have caught this
cosmos-evm is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are reportedly affected if you are using cosmos-evm versions <0.6.2 or >=0.6.2.
What should I do right now?
Upgrade to the latest version of cosmos-evm and monitor for any suspicious activity in affected environments.
Has this been exploited in the wild?
Yes, the vulnerability has been reportedly exploited in the wild.