Cosmos EVM module security exploit

A critical security vulnerability in the Cosmos EVM module, identified as ASA-2026-002, led to significant exploits across multiple blockchain networks in August 2026. The flaw involved the ICS20 precompile component, which caused incorrect state handling during nested EVM execution, allowing attackers to manipulate balance and ownership tracking during cross-chain token transfers.

Initially, Cosmos Labs reported receiving notice of the flaw via a bug bounty program in April 2026. At that time, the company believed the vulnerability posed no risk to live networks and implemented a silent patch in May. However, independent researchers determined in early August that the bug affected all Cosmos EVM chains.

Following the release of patched versions on August 19, exploits began within 20 hours. Between August 20 and August 25, attackers targeted six blockchain networks, resulting in approximately $5.72 million in stolen assets. MANTRA Chain was among the most heavily impacted, losing tokens valued at roughly $3.6 million. In response to the breach, Cosmos Labs coordinated with 40 chains, advising affected validators to halt network operations to contain the incident.