Affected Systems

Cosmos EVM module versions < 0.6.2 and >= 0.7.0 < 0.7.2. All blockchains running Cosmos EVM with permissionless vesting account creation are vulnerable. Six chains were exploited August 20–25, 2026. Fixed in v0.6.2 and v0.7.2 (released August 19).

Exploitation Status

Actively exploited in the wild. Six blockchains were drained between August 20–25, 2026. The vulnerability was reported via bug bounty on April 25, 2026, and the fix was publicly committed to the main branch on May 15 before exploitation began.

Business Impact

Attackers exploited a balance-handling flaw to mint unlimited tokens or burn victim balances by wrapping account balances to 2^256 through unchecked subtraction. Exploitation requires permissionless vesting account creation. Chains on 0.6.x halt on supply overflow; chains on 0.7.x accept arbitrary balance changes. No CVE or CVSS score published. Cosmos Labs initially misassessed the flaw as low-risk and used a public silent patch process instead of private emergency distribution, despite knowing all production chains were vulnerable by August 13. The patch requires a state-breaking coordinated network upgrade.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Cosmos EVM to v0.6.2, v0.7.2, or later via coordinated network upgrade; halt chain immediately if upgrade cannot be deployed within hours
  • Block MsgCreateVestingAccount, MsgCreatePermanentLockedAccount, and MsgCreatePeriodicVestingAccount in the ante handler to close the precondition for exploitation
  • Verify the live code path on a fork to confirm the SubBalance underflow guard (PR #1176), locked-balance snapshot (PR #1187), and module-account guard (commit 3524ebc) are all applied; cherry-picks may leave unexported duplicate helpers unpatched
  • Do not rely on disabling the staking precompile as a mitigation; it removes the primary trigger but is not a substitute for patching
  • Register a security contact with Cosmos Labs if operating a Cosmos EVM chain; eleven deployments were discovered during the incident that had no registered security channel