Cosmos EVM Hack: The Patch Was in Main for 96 Days

The fix for the flaw that drained six Cosmos chains remained merged in the main branch of cosmos/evm for 96 days before anyone backported it to the release branches on August 19, 2026, at 17:53 UTC. The version that finally incorporated it, v0.7.2, was published at 23:01:54 that same day, and the first attack on MANTRA occurred 20 hours and 4 minutes later. That journey—from a pull request merged in May to an exploited block in August—can be reconstructed entirely using the public GitHub API, without privileged access and using the repository's own timestamps. This article follows that trail commit by commit and tag by tag: what was fixed on May 15, why it remained excluded from published versions for three months, what a diligent operator who updated in July would have seen, and what the minute-by-minute chronology of the five-day theft spree reveals.

What failed in the Cosmos EVM StateDB to cause a balance to wrap to 2²⁵⁶?

Cosmos EVM is the piece of software that allows a chain in the Cosmos ecosystem to execute Ethereum contracts. To achieve this, it must keep two accounting systems synchronized: the StateDB (the balance view expected by the Ethereum Virtual Machine) and x/bank (the balance module of the Cosmos SDK, the kit used to build these chains). The flaw lives exactly at the seam between the two.

The StateDB only models the spendable balance of an account. Cosmos SDK vesting accounts—accounts with locked tokens released according to a schedule—have two figures: spendable and locked. And the x/staking module, along with the EVM staking precompile, also allows the locked portion to be delegated. When a vesting account delegated more than its spendable balance, the SubBalance function of the StateDB performed a subtraction without first checking if sufficient funds existed. Since the uint256 type does not support negative numbers, the subtraction did not trigger an error: it wrapped the balance around to approximately 2²⁵⁶.

The second half of the attack utilizes this impossible balance. The attacker would send 2^256 − balance(victim) tokens to an account with a high balance—the zero address or a multisig created at the chain's genesis—triggering a reverse overflow: the victim was left at zero and the attacker kept their balance. Because both operations are linked in a single transaction, the net change in total supply is zero, making the movement much less visible to any alarms monitoring token issuance.

The preliminary setup explains why this was not a laboratory accident. According to the Cosmos Labs post-mortem published on August 28, 2026, the attacker pre-calculated the deterministic address where a contract would be created, established a vesting account there, and then deployed a malicious contract on top of it. With this combination, they triggered the underflow and overflow within the same supply-neutral transaction.

A behavioral detail separates the two release branches and determines the severity of the attack. The 0.6.x line reconciles with the SDK ledger by minting and burning, so massive minting caused a total supply overflow that halted the chain. The 0.7.x line writes balances directly to x/bank and accepts the change as long as it survives the conversion from uint256 to int256. In practice, 0.6.x chains halted themselves during the attempt, while 0.7.x chains recorded the modified balance and continued producing blocks.

Why did the Cosmos EVM fix take 96 days to reach a published version?

The fix timeline begins on April 25, 2026, when a researcher reported the vulnerability through the bug bounty program on HackerOne. The report included a proof of concept demonstrating the theft of funds in several untagged versions of Cosmos EVM. Cosmos Labs attempted to reproduce this theft in the then-supported versions —v0.6.0 and v0.5.1— using various network configurations; they were unsuccessful in those with 18 decimals and concluded that loss of funds could only occur on networks with decimals other than 18. Since all known production Cosmos EVM networks used 18 decimals, the risk assessment determined that user funds in production were not under threat.

That paragraph must be read in its second version. On September 10, 2026, at 21:17 UTC, thirteen days after publishing the report, Cosmos Labs modified it and added a corrections section at the end: "a previous version of this report incorrectly stated details of the proof of concept included in the first bug bounty submission." The original version described that proof as pertaining to "a 6-decimal Cosmos EVM network," which presented it as a marginal configuration case; the corrected version states that it demonstrated theft of funds, and attributes the error to the scope of the reproduction tests, which were limited to the two versions supported at that time. The change does not alter any of the dates in this timeline, but it does change the starting point: what arrived on April 25 was a demonstration of theft of funds, not a case of decimals.

This classification triggered a specific and public policy: the silent patch and disclosure process, reserved for flaws that do not cause loss of funds in production chains. The fix is merged openly into main, without declaring what it corrects, trusting that its security relevance will not be obvious to anyone reading the repository. PR #1176, "fix: harden statedb balance and event amount handling," was opened on May 13, 2026, at 15:50 UTC and merged on May 15: 190 lines added, 191 deleted, 15 files touched.

This is where the clock stops. The post-mortem explains that the patch was not immediately backported to release branches because it was state-breaking: it changes the chain state and forces validators into a coordinated update, something not expected from a maintenance release. The decision was made to wait for the next minor version, when operators would already expect to coordinate.

That minor version never arrived. v0.7.0 had been published on May 5, 2026, ten days before the fix was merged, so the coordination window had just closed. The cosmos/evm tag list consulted on September 7, 2026, contains no v0.8.x: between May 15 and that date, the repository only published stable maintenance versions—v0.6.1 and v0.7.1 on July 27, v0.6.2 and v0.7.2 on August 19, v0.6.3 and v0.7.3 on September 3. The fix had been waiting 117 days for a minor version that does not exist (proprietary calculation based on the tags API, counted until September 9, 2026).

In early August, additional reports arrived from independent researchers with enough information to reproduce the flaw more broadly. The team then confirmed that all Cosmos EVM chains were affected, regardless of their decimals. At that point, the standard policy for a flaw that does threaten funds in production is to distribute the patch via private channels to affected networks. Cosmos Labs reasoned that, since the fix had been public in main for months without known exploitation, it was safe to continue via the silent route: the patch was obfuscated, backported to release/v0.6.x and release/v0.7.x, and published with release notes that mentioned security without describing urgency or severity.

Advisory GHSA-7g4w-cg88-2cq2 (GitHub Security Advisory, the repository's own security notice log), published on August 28, 2026, sets the vulnerable ranges for Cosmos EVM at < 0.6.2 and >= 0.7.0 < 0.7.2. A validator who did the right thing on July 27, 2026—updating to the latest version published that day, v0.7.1—remained exposed for an additional 23 days and 7 hours until v0.7.2 was released on August 19 at 23:01:54 UTC; during that period, the fix had been available in main for between 73 and 96 days, and no release note gave them reason to seek it out. The subsequent margin was even narrower: the first attack on MANTRA—the Cosmos ecosystem's tokenized asset chain—was executed at block 17444928 on August 20 at 19:06:00, just 20 hours and 4 minutes after the tag was published. In that time, an operator had to detect, understand, and coordinate a state-breaking update based on a note that mentioned security without specifying severity (proprietary calculation based on release API publication timestamps).

What was the chronology of the Cosmos EVM hack on MANTRA, TAC, and KiiChain (August 20-25, 2026)?

The full attack window spans from August 20 at 19:06 UTC to August 25 at 15:20 UTC: four days and 20 hours. The following table reconstructs the milestones using the post-mortem timestamps and adds the measured interval between each event and the previous one, calculated from those same marks.

Three figures from this table deserve to be read together. First: MANTRA took 4 hours and 7 minutes to halt the chain from the initial attack, enough time for the attacker to re-enter a second time at 22:59:01. Second: TAC received the Slack notice on August 21 at 09:33:15 and was attacked 34 hours and 13 minutes later, on August 22 at 19:46:37—the post-mortem confirms the TAC team had received the prior communication regarding the update. Third: between the transaction that removed 2.985 billion TAC from the staking pool and the first sale on KyberSwap, only 2 minutes and 57 seconds elapsed, with funds arriving on BNB Chain at exactly 60 seconds. The human reaction window for such a sequence is non-existent.

It is important not to flatten the distinction between channels. Cosmos Labs sent warnings via private routes—secure email and Slack—on August 21, while rekt.news and Cryptotimes place the first public acknowledgment of the incident on August 24 and the public recommendation to halt chains on August 25: private communication preceded public notice by three days. KiiChain published its own technical post-mortem on August 23, five days before Cosmos Labs.

Why did the Push Chain fork PR state that no Cosmos EVM version included the fix?

On August 20, 2026, at 07:16:09 UTC, a developer from the Cosmos EVM fork maintained by Push Chain opened pull request #40 in their public repository. The PR did what any responsible team does with a flaw detected in their audit: incorporate the fix. Its title cites the Hacken audit identifier, F-2026-18201, and its body describes the exploitation path with manual-like precision—the unchecked subtraction in SubBalance, the wrap to 2²⁵⁶, and the two payment variants (minting or draining).

The PR also includes a provenance table with a column titled "Has fix" where it marks v0.6.0, v0.7.0, v0.6.1, v0.7.1, and the three v1.0.0-rc versions as "NO," and only main as "YES." It concludes in text: the fix exists solely in upstream main, is not in any tagged version, and updating to a published tag solves nothing because the patch must be manually brought in via cherry-pick.

That table was written 8 hours and 14 minutes after v0.7.2 had already published the fix. The Cosmos Labs post-mortem confirms this bluntly: the pull request does not mention v0.6.2 or v0.7.2, and claims that updating to a published tag would not remedy the problem. That gap measures how much the obfuscated patch concealed: a developer who was looking at that fix commit by commit, with the audit identifier in hand, did not see that the version published eight hours earlier already contained it.

The PR remained open and visible until August 24 at 01:46 UTC, with the attack window still open. The post-mortem places it before the first known incident and warns that publishing exploitation paths "can increase the risk of an exploit"; 11 hours and 50 minutes separate its publication from the first attack on MANTRA (proprietary calculation). This sequence forces a careful conclusion. If the attacker's only source was that pull request, the 96-day delay was not the cause of the theft; it was the condition that made it possible, because a timely backport in May would have left the document with no vulnerable chains to target. The policy left the door open, and something else pushed it.

Furthermore, a disagreement on severity remains regarding the same defect: Hacken classified it as High in its F-2026-18201 file, while the Cosmos Labs advisory published it as critical. The difference matters because severity determines whether a disclosure goes through a private channel or a public pull request.

Was $20.8 million or $5.72 million stolen in the Cosmos EVM hack?

Two figures are circulating, and both are correct because they measure different things. Cosmos Labs accounts for $5.72 million realized across six chains: $2.87 million sold on decentralized exchanges at August 19, 2026 prices—with the literal breakdown of 2,613,674.48 USDT — 114.129045 ETH — 93.78 TON — 1.393618 USDC — 98.87 OSMO— plus an estimated $2.85 million on centralized exchanges based on public volume data; the document itself warns that these figures have not been independently audited and that centralized exchange accounts are frozen pending police investigation. In contrast, the specialized press sums the nominal value at pre-exploit prices of the tokens extracted from three chains: $3.6 million on MANTRA, plus $7.5 million on TAC and $9.7 million on KiiChain, totaling $20.8 million.

The bridge between the two is arithmetic and can be reconstructed using post-mortem data.

The calculation is proprietary: the pre-exploit price is derived by dividing the nominal press figure by the extracted tokens provided in the post-mortem, and the realized price by dividing the USDT revenue by the tokens actually sold. The result explains the 3.64x ratio between the $20.8 million and $5.72 million in the Cosmos EVM hack: the attacker could only offload four out of every ten stolen tokens, and at one-third of the previous price. On KiiChain, 80.7 million KII—54.4% of the total extracted—remained within the chain itself, recoverable after network restoration; on BNB Chain, approximately 1.662 billion TAC remained unsold as of the post-mortem date (August 28).

The most extreme case of this gap is found in a fourth chain not detailed in the post-mortem. According to the analytics firm Bubblemaps, cited by BeInCrypto on August 27, 2026, the attacker inflated their balance on the Nesa chain by about 200 times, moved the nominal equivalent of about $50 million in NES, and walked away with approximately $60,000 net: 0.12% of the nominal value (proprietary calculation). These are third-party analytics data reported by the press, not from the primary document, which omits three of the six chains for brevity.

One final data point puts the scale of the problem in perspective, and it runs counter to intuition. The combined DeFi TVL (total value locked) of TAC and MANTRA totaled $1,075,822 on September 6, 2026, according to DefiLlama—$534,005 for TAC, down 28.0% from August 19, and $541,817 for MANTRA, virtually flat. The $5.72 million realized is 5.3 times that sum. The money did not come from DeFi protocols: it came from the bonded_tokens_pool, vesting accounts, a genesis multisig, and a burn address. The exposed surface was the chain's own balance ledger, measured by bonded stake (tokens delegated to validators) and the locked balances of treasury accounts.

Why did a second critical flaw appear in the Cosmos EVM StateDB 15 days later?

On September 3, 2026, at 17:53:58 UTC, cosmos/evm published advisory GHSA-367m-g444-9mg3, "Non-atomic StateDB commit," also of critical severity. The vector is different—the non-atomic commit of the StateDB via the IBC (Cosmos inter-chain communication protocol) middleware of x/erc20—but the component is the same, and the vulnerable ranges include precisely the versions the August advisory pointed to as the remedy: >= 0.7.0 < 0.7.3 and >= 0.6.0 < 0.6.3.

The operational consequence is direct. Chains that obeyed the emergency order of August 21 and updated to v0.7.2 were exposed again for 14 days and 18 hours, until v0.7.3 was published on September 3 at 17:52:40 UTC. Tag comparison shows that between v0.7.2 and v0.7.3 there is a single commit, c3ae9067a, with the brief message "Merge commit from fork": the one that generates the fix flow in the private repository that GitHub associates with security advisories.

These are five critical advisories in sixteen months, from May 13, 2025, to September 3, 2026, regarding a dependency shared by dozens of sovereign chains. None have a CVE (the standard vulnerability identifier) or a CVSS severity score assigned in the GitHub API, leaving them off the radar of vulnerability inventory tools used by many infrastructure teams by default. Added to this is the context documented by Cosmos Labs itself: over $850,000 paid in bug bounties since January 2025, 37 vulnerabilities patched silently in the thirteen months prior to the post-mortem (July 2025 to August 2026), and a Sherlock audit—the contest-based audit platform—published in July 2025 that failed to detect this flaw.

What can a Cosmos EVM operator check before the next silent patch?

The post-mortem quantifies the part of the problem that no disclosure policy solves alone: the Cosmos ecosystem encompasses more than 115 known public chains, and the software is free and deployable without permission. Cosmos Labs coordinated with 40 chains, six were exploited, and thirteen potentially exposed networks patched, halted, or mitigated without incident. It is best not to turn this into a "only 13 out of 40 reacted" narrative: the 40 are the chains with which there was coordination during the response, and the census of truly exposed networks has never been published.

Cosmos Labs has committed to reviewing the triage of critical vulnerabilities and publishing standards on when halting a chain is recommended over updating, and when a private channel is used instead of a silent patch. Until those standards exist, verification remains the responsibility of the operator, and these five checks can be performed with the public GitHub API without being on any list:

1. Compare the deployed tag directly against main: The /compare/<tag>...main endpoint returns the missing commits. In this case, the one that mattered had been on the list since May 15, 2026, and contained the word statedb in the message.
2. Monitor the repository's own advisories section. The five critical cosmos/evm advisories are published at /security/advisories with their affected version ranges, from May 13, 2025, to September 3, 2026.
3. Treat "mentions security without detail" as a signal, not noise. The notes for v0.6.2 and v0.7.2 on August 19, 2026, were worded this way by policy, and that is exactly what a backported silent patch looks like.
4. Register the team's security contact. Eleven Cosmos EVM deployments found out late in August 2026 because no one from their team was on the Cosmos Labs mailing list.
5. Measure exposure with bonded stake and locked balances. DeFi TVL falls far short as a measure of the scope of such a flaw: the $5.72 million realized was 5.3 times the combined DeFi TVL of TAC and MANTRA on September 6, 2026.

For those who hold tokens on a Cosmos EVM chain but do not operate a validator, the lesson is simpler to apply: the balances at risk here were those in vesting accounts, genesis treasuries, and staking pools—positions that no one checks daily. The release schedule of the repository your chain depends on is public information, and the distance between the last deployed tag and main can be checked in a browser.

Sources and links: Cosmos Labs — post-mortem GHSA-7g4w-cg88-2cq2 (28-ago-2026) · Post-mortem correction (commit, 10-sep-2026) · Cryptotimes — public halt recommendation (25-ago-2026) · Advisory GHSA-7g4w-cg88-2cq2 · Advisory GHSA-367m-g444-9mg3 (3-sep-2026) · cosmos/evm PR #1176 · Comparison v0.7.1...v0.7.2 · Release v0.7.2 · pushchain/push-chain-evm PR #40 · Cosmos SDK — silent patch and disclosure process · Sherlock — Interchain Labs Collaborative Audit Report (jul-2025, PDF) · rekt.news — KiiChain · crypto.news (31-ago-2026) · DefiLlama — TAC historical TVL