Cosmos EVM Vulnerability: Six Chains Affected

If you hold tokens on a smaller blockchain, your balance depends on two things: on that blockchain, and on the software it shares with many others. August made exactly that visible. A flaw in a shared building block called Cosmos EVM was exploited on six blockchains between August 20 and 25, 2026. Around $5.72 million drained away, three chains halted operations, and Cosmos Labs says it contacted 40 networks. On August 28 the team published a post-mortem that describes the sequence openly. This article sets out what happened, why the damage figures in circulation diverge so widely, and what you can check if you hold tokens on an affected chain.

The Cosmos EVM vulnerability at a glance: $5.72 million from six chains

Cosmos EVM is a software module that extends a Cosmos blockchain with an Ethereum-compatible execution environment. A module in this sense is a finished code package that a chain team builds into its own blockchain instead of writing the function itself. The advantage is speed. The price is a shared dependency: a flaw in the module is a flaw in every chain that uses it.

The vulnerability carries the identifier GHSA-7g4w-cg88-2cq2 and is classified as critical by Cosmos Labs itself. According to The Hacker News it was published without a CVE number, without a vulnerability classification and without a CVSS score. Affected are the versions below 0.6.2 as well as those from 0.7.0 up to but not including 0.7.2; the flaw was fixed in v0.6.2 and v0.7.2, which appeared on August 19, 2026.