Cosmos EVM Shared-Module Integer Underflow: Six-Chain $5.72M Theft; Silent Patch Process Stretched the Attack Window

Cosmos Labs' 28 August postmortem discloses GHSA-7g4w-cg88-2cq2: attackers used an integer underflow in Cosmos EVM balance checks to wrap account balances to 2^256-1 and stole ~$5.72M across six Cosmos-family public chains. The bug was filed via bug bounty on 25 April. Maintainers mis-scored impact and shipped a silent patch, leaving an attack window of more than 11 hours. MANTRA and several other chains took major losses.

Incident Overview

On 28 August 2026, Cosmos Labs published a technical postmortem covering the full timeline and blast radius of GHSA-7g4w-cg88-2cq2. Over five days from 20 August to 25 August, attackers exploited an integer underflow in the balance-check module of Cosmos EVM (the community-shared EVM execution layer) and stole ~$5.72M in digital assets from six Cosmos-family public chains including MANTRA, TAC, and KiiChain (~$2.87M sold via DEX, ~$2.85M via CEX; several CEX accounts frozen). Root cause is not only the bug. Maintainers mis-scored severity and botched patch distribution. Researchers filed the defect through the Cosmos Labs bug-bounty program on 25 April. Testers could not reproduce the attack under production 18-decimal precision, labeled it as not threatening production-chain funds, and shipped a silent patch. That process publishes no vuln-specific advisory and pushes no emergency notice. All Cosmos EVM chains were confirmed affected only on 13 August. The patch went public at 19:01 ET on 19 August.

Technical Details

The bug sits in glue code that reconciles Cosmos EVM against the Cosmos SDK x/bank module:

• State-model mismatch: EVM StateDB tracks only spendable balance. Vesting accounts in the SDK hold both spendable and locked balances; locked can still be delegated to validators via native staking and the staking precompile;
• Underflow trigger: when a vesting account delegates more than its spendable balance, post-delegation writeback subtracts spendable with no unsigned check. Result wraps to 2^256-1 (~78-digit number);
• Asset transfer: when the attacker moves the wrapped amount to a target account, state reconciliation fires mint / burn on the target for the delta. Unclaimed large balances on burn addresses and long-dormant multisigs transfer to attacker-controlled wallets without actually creating tokens;
• Runtime split: on 0.6.x a short-lived large mint trips supply overflow and halts the chain. On 0.7.x balances write straight into x/bank; after uint256/int256 conversion the state is accepted. 0.7.x does not halt on its own; losses are more direct.

Exploit requires (1) the chain allows permissionless vesting-account creation, (2) the attacker pre-deploys a malicious contract via CREATE2 to a precomputed address, (3) that contract account is converted into a vesting account. Balance wrap + asset transfer complete in a single transaction.

Impact

• Affected versions: Cosmos EVM earlier than v0.6.2 and v0.7.2. Hits 6 confirmed attacked Cosmos chains plus 13 more notified to patch / halt / defend;
• 11 deployments not registered in the Cosmos Labs security mailing list. Underscores the missing unified asset inventory across 115+ public Cosmos chains;
• Loss split: MANTRA lost ~72.09 billion MANTRA (~$3.6M) from burn address and dormant multisig. TAC lost nearly 3 billion tokens; ~1.2 billion swapped on BNB Chain for ~$950k. KiiChain lost ~148 million KII;
• Cosmos Labs disclosed the silent patch process was used 37 times in the past 13 months. This incident is a textbook case of process failure amplifying a technical bug.

Remediation

• All Cosmos EVM chain maintainers: upgrade immediately to v0.6.2 or v0.7.2+. Upgrade is state-breaking. Coordinate 38+ validators network-wide;
• Chains that cannot upgrade in the short term must halt block production. Do not attempt upgrade-while-governing;
• Reject MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, MsgCreatePeriodicVestingAccount in the ante handler. Close the exploit preconditions. Enforce via governance params or emergency patch;
• Independently verify locked-balance snapshot and module-account guard fixes were cherry-picked. The fix spans three commits (PR #1176, PR #1187, commit 3524ebc). Some maintainers may have synced only the first;
• After upgrade, add extra audits of genesis vesting accounts on explorers, RPC, and signing services. Stand up long-term alerts on burn-address / dormant-multisig balance changes;
• On the CEX side, handle post-incident refunds and user comms. Avoid secondary harm from blacklisted liquidity after attacker-held CEX accounts unfreeze.

References

• The Block: Cosmos Labs says it wrongly cleared the bug behind a $5.7M six-chain hack
• GHSA-7g4w-cg88-2cq2
• Daily Crypto Briefs: Cosmos EVM Flaw Drained $5.72M
• Mango Developer: Silent Patch Process Analysis