security · "Cosmos EVM" · "vulnerability disclosure" · "cross-chain security"
Cosmos Labs Says a Bug It Cleared Was Later Used in a Six-Chain Hack
An integer-underflow vulnerability reported in April was misclassified before attackers exploited Cosmos EVM deployments in August.
Cosmos Labs says attackers exploited an integer-underflow vulnerability across six Cosmos-based chains after its own testing process had wrongly concluded that deployed networks were not vulnerable.
The flaw was reported by a security researcher on April 25. Cosmos Labs’ post-mortem says testers later cleared the issue for live chains and prepared a silent patch. Updated Cosmos EVM releases were published only about 20 hours before the first known attack, with release notes that did not spell out the security impact.
Attackers exploited affected chains between August 20 and August 25. Public reporting places the combined proceeds near $5.7 million, while the Cosmos security post-mortem says approximately $2.87 million in affected assets were later bridged away and sold on decentralized exchanges. Those figures describe different stages of the incident and should not be conflated.
MANTRA suffered the largest reported impact at roughly $3.6 million. TAC, KiiChain and three other networks were also affected. Patched branches include Cosmos EVM v0.6.2 and v0.7.2.
Blue Rogues interpretation: this was not only a code failure. The timeline points to a triage and coordination failure: a real vulnerability was downgraded, then disclosed too softly and too close to exploitation for every operator to react safely.
What to watch: chain-level accounting, recovery efforts, adoption of patched versions and changes to Cosmos Labs’ vulnerability-disclosure process.
Sources:
- https://github.com/cosmos/security/blob/main/communications/cosmos_evm_GHSA-7g4w-cg88-2cq2_post_mortem.md