Cosmos Labs disclosed a critical vulnerability in its shared EVM module that was actively exploited to drain funds across six blockchains during a five-day window in late August 2026. The flaw, tracked as GHSA-7g4w-cg88-2cq2, allowed attackers to manipulate balance-handling logic and extract cryptocurrency from affected chains.
The vulnerability exists in versions below 0.6.2 of the Cosmos EVM module, a shared component used by multiple blockchain networks built on the Cosmos ecosystem. Balance handling refers to how the module tracks and verifies user account balances. A flaw in this logic creates an opening for attackers to bypass normal validation checks and transfer funds they do not own.
Six blockchains fell victim between August 20 and August 25, 2026. Cosmos Labs has not disclosed the specific chains or the total value extracted, though the brevity of the exploitation window suggests either rapid detection or swift remediation efforts by affected networks. The timeline raises a critical question about disclosure practices. Cosmos Labs rated the flaw as Critical, yet did not publish it with a CVE identifier, CVSS score, or formal weakness classification. This absence of standardized security metadata slows information sharing across security teams and creates friction in patch prioritization efforts.
The Cosmos EVM module runs as a shared infrastructure component across multiple independent blockchains. Unlike monolithic chains, Cosmos uses a modular architecture where validators can deploy common modules across networks. This design maximizes code reuse but concentrates risk. A single flaw affects every network using that module, and exploitation can ripple across the entire ecosystem simultaneously.
The five-day exploitation window between discovery and disclosure suggests either that the vulnerability was exploited in the wild before Cosmos Labs announced it, or that affected chains acted independently without coordinated public communication. Either scenario indicates a gap in coordinated disclosure practices for shared infrastructure in decentralized networks. Blockchain projects typically announce patches before exploitation occurs. The lag here compressed response time for downstream users.
Cosmos Labs advised users to upgrade to version 0.6.2 or later immediately. Networks running older versions remain exposed. For blockchain validators and token holders on affected chains, the priority is verifying whether their chain has applied the patch and confirming whether their accounts experienced unauthorized balance transfers during the exploitation window.
The lack of a CVE identifier complicates tracking this vulnerability in enterprise security tools and databases. Most organizations rely on CVE numbers to correlate threats across their infrastructure. Without one, security teams must monitor Cosmos-specific advisories rather than relying on centralized threat intelligence feeds. Cosmos Labs should have assigned a CVE before or immediately after disclosure to enable faster detection and response across security operations centers.
This incident demonstrates why modular blockchain architecture requires robust disclosure coordination. When a single component serves dozens of chains, a vulnerability becomes a systemic risk. Cosmos Labs needs to establish formal SLAs for patch availability and coordinated disclosure timelines that give all affected networks simultaneous access to fixes, reducing the window for exploitation.
Organizations operating Cosmos EVM chains should inventory their module versions now and complete upgrades to 0.6.2 within 24 hours if not already patched.