Cosmos EVM Vulnerability Drives $5.7M Six-Chain Hack
A critical Cosmos EVM vulnerability was exploited across six blockchain networks between 20 and 25 August 2026, draining an estimated $5.72 million through decentralised and centralised exchanges. The flaw affected Cosmos EVM versions below 0.6.2 and versions from 0.7.0 to below 0.7.2. Patches were released on 19 August, about 20 hours before the first known attack.
The vulnerability was reported through Cosmos Labs’ bug bounty programme on 25 April, but it was initially judged not to affect production systems. An unchecked subtraction in StateDB allowed a vesting account that delegated more than its spendable balance to trigger an unsigned-integer overflow. Attackers could then create artificial balances or transfer funds without obtaining validator, administrator, governance or multisig keys.
Cosmos Labs estimated that about $2.87 million moved through decentralised exchanges and $2.85 million through centralised platforms. MANTRA separately reported the loss of 720,923,967.99 MANTRA tokens, valued at about $3.6 million before the attack. Three affected chains halted block production, while 13 others were patched or secured before exploitation. Eleven additional installations were identified during the review. MANTRA, KiiChain and TAC were among the publicly identified networks.
The incident increases short-term risk for affected tokens, particularly MANTRA’s OM, because of forced selling, reduced liquidity and uncertainty over chain operations. Traders should check block production, wallet balances, software versions and exchange deposits or withdrawals. Cosmos Hub and ATOM were not affected because they do not use Cosmos EVM. The episode also highlights the market risks of silent security patches, delayed disclosure and short upgrade windows for shared blockchain infrastructure.
Bearish
The direct price impact is bearish, especially for MANTRA’s OM token and other assets linked to the affected networks. The exploit created artificial balances and enabled unauthorised transfers, which can lead to forced selling, exchange restrictions, thinner liquidity and increased volatility. MANTRA’s reported loss of more than 720 million tokens adds a significant supply and confidence overhang.
In the short term, traders may sell affected tokens or avoid deposits and withdrawals until chains complete upgrades and exchanges confirm settlement. Halted block production and uncertainty over token balances can widen spreads and amplify price moves. The estimated $5.72 million in realised proceeds is modest relative to the wider crypto market, so the event is unlikely to materially affect Bitcoin or the broader market on its own.
Longer term, the incident may weigh on affected projects through reputational damage, delayed recovery and higher security costs. Cosmos Hub and ATOM should see limited direct price impact because they do not use Cosmos EVM. Broader confidence in shared Cosmos EVM deployments may weaken, although successful patching, compensation measures and restored chain operations could reduce the pressure.