Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Cosmos Labs disclosed a critical balance-reconciliation flaw (GHSA-7g4w-cg88-2cq2) in the shared Cosmos EVM module that was exploited to drain funds from six blockchains between August 20–25, 2026. The flaw arises when vesting account locked balances are mishandled during EVM↔SDK reconciliation, allowing underflow/wrapleading to large mints or burns; exploitation requires permissionless vesting-account creation. Fixes were released in v0.6.2 and v0.7.2 (state-breaking upgrades), operators are advised to upgrade or halt chains, and Cosmos reported roughly USD 2.87M sold on DEXs and USD 2.85M on CEXs tied to the incident; the report also criticizes the silent-patch handling and downstream patching gaps.