Cosmos Labs has disclosed that a critical flaw in the shared Cosmos EVM module was actively exploited to drain funds from six separate blockchains between August 20 and August 25, 2026. The advisory, tracked as GHSA-7g4w-cg88-2cq2, was published without a CVE identifier, without a weakness classification (CWE), and without a CVSS score, despite Cosmos Labs rating the issue Critical.

The flaw centers on balance-handling logic within the Cosmos EVM module, a shared component used by multiple independent chains in the Cosmos ecosystem to support Ethereum Virtual Machine compatibility. Because the vulnerable code is shared infrastructure rather than something unique to a single chain, every blockchain that integrated the affected module inherited the same exposure.

What Made This Different

What distinguishes this incident is not just the exploitation itself, but the timeline. Cosmos Labs has acknowledged that it was aware every blockchain running the vulnerable module was at risk before attackers began draining funds. That knowledge gap between disclosure and remediation across a decentralized, multi-chain ecosystem appears to have given attackers a window to act before affected projects could patch.

Cosmos Labs lists affected versions as those prior to 0.6.2, alongside a separate range of later versions also flagged as vulnerable, underscoring that the issue was not isolated to a single old release but persisted across multiple version lines of the module.

Why Shared Modules Raise the Stakes

Incidents like this highlight a structural risk in blockchain ecosystems built on shared, reusable modules. A single balance-handling defect in common code can simultaneously expose every downstream chain that adopted it, turning what might otherwise be a contained bug into a multi-chain incident. Coordinating disclosure and patching across independently operated chains adds complexity that traditional single-vendor software patching does not face.

Recommendations

  • Chain operators running the Cosmos EVM module should immediately verify their deployed version against the affected ranges identified in GHSA-7g4w-cg88-2cq2.
  • Upgrade to a patched release as soon as one is confirmed available and validated.
  • Review on-chain balance activity for the affected window (August 20-25, 2026) to identify any anomalous fund movements.
  • Monitor Cosmos Labs advisories for further detail, since the published disclosure currently lacks a CVE, CWE, and CVSS score.