# Six Blockchains Drained: Cosmos EVM's Balance Flaw Sat Ticking While Labs Stayed Quiet
## The Threat
Between August 20 and August 25, 2026, attackers exploited a critical flaw in the Cosmos EVM shared module — a component that every Cosmos-based blockchain running Ethereum Virtual Machine compatibility inherits from the same codebase. The vulnerability is a balance-handling bug: the module incorrectly manages native token balances under specific conditions, creating an opening for an attacker to manipulate accounting state and extract funds that don't exist on paper, or drain balances that do.
Six separate blockchains lost funds over five days. That isn't a single chain getting targeted — it's the same exploit running against the same underlying code across an ecosystem of interconnected networks, each believing they were operating independently until they weren't.
What makes this worse than a standard disclosure is the headline buried in Cosmos Labs' own advisory language: the organization knew that every blockchain running the shared EVM module was vulnerable. The module is shared by design — it's the whole point of Cosmos's modular architecture. When you ship a critical bug in a shared component and delay coordinated disclosure, you don't have one victim. You have as many victims as there are chains in production.
The coordinated multi-chain exploit window — five days — suggests attackers had advance knowledge, were methodical, or both. Each chain hit represented a separate drain event against what was functionally the same attack surface. Security researchers and on-chain analysts are still tallying losses.
## Severity and Impact
The advisory was published without a CVE identifier, CVSS score, or CWE classification — a disclosure gap that deserves its own scrutiny.
| Field | Detail |
|---|---|
| Advisory ID | GHSA-7g4w-cg88-2cq2 |
| CVE | Not assigned |
| CVSS Score | Not provided |
| CVSS Vector | Not provided |
| CWE | Not assigned |
| Cosmos Labs Severity | Critical |
| Attack Type | Balance-handling manipulation via EVM module |
| Chains Exploited | 6 confirmed |
| Exploitation Window | August 20–25, 2026 |
| Patch Version | 0.6.2 |
The absence of CVE, CVSS, and CWE identifiers isn't a paperwork technicality — it means this vulnerability doesn't show up in standard security scanner databases, SIEM correlation rules, or automated patch-management workflows. Any chain operator relying on those pipelines to flag urgent updates had no signal to act on.
## Affected Products
All Cosmos-based blockchains running the shared EVM module on the following versions are affected:
Six chains were confirmed exploited in the wild. Additional chains running vulnerable versions but not yet targeted should assume they remain at risk until patched. The Cosmos ecosystem includes dozens of production chains using this module.
## Mitigations
Immediate priority — upgrade now:
Additional defensive measures:
## References
---
## HackWire Analysis
The Cosmos EVM incident is being framed as a vulnerability story. It's actually a disclosure governance story wearing a vulnerability story's clothes.
Shared modules are the entire value proposition of the Cosmos architecture — build once, deploy across many sovereign chains. That modularity is a feature until it isn't. When a critical flaw lands in a shared component, the attack surface multiplies by the number of chains that shipped it. The responsible path is coordinated, simultaneous disclosure to every affected chain operator with enough lead time to patch before details go public. What happened here — six chains drained over five days while Labs presumably knew the scope — suggests either that coordination broke down, or it didn't happen at all.
The lack of CVE, CVSS, and CWE assignment isn't just sloppy. It's operationally harmful. Blockchain projects running automated security tooling, institutional chains with compliance-driven patch management, and independent validators who rely on public databases to triage alerts all had no standardized signal to catch this. Cosmos Labs rated it Critical but published it in a format that security infrastructure doesn't know how to parse.
The five-day exploitation window is the tell. Either attackers had inside knowledge, or they found the bug independently and worked systematically through the ecosystem. Neither scenario reflects well on the disclosure timeline. Blockchain ecosystems in particular need robust bug bounty programs, pre-disclosure chains of custody, and — critically — the ability to coordinate emergency patches across dozens of independent governance processes simultaneously. That is hard. It's also not optional when shared code is the foundation.
The six chains confirmed drained will not be the last number we hear. Full loss accounting in a multi-chain exploit takes weeks.
— HackWire Editorial
---
## Related Coverage