Cosmos EVM Vulnerability: $5.72 Million From Six Blockchains and Why Three Chains Had to Halt

If you hold tokens on a smaller blockchain, your balance depends on two things: on that blockchain, and on the software it shares with many others. August made exactly that visible. A flaw in a shared building block called Cosmos EVM was exploited on six blockchains between August 20 and 25, 2026. Around $5.72 million drained away, three chains halted operations, and Cosmos Labs says it contacted 40 networks. On August 28 the team published a post-mortem that describes the sequence openly. This article sets out what happened, why the damage figures in circulation diverge so widely, and what you can check if you hold tokens on an affected chain. The Cosmos EVM vulnerability at a glance: $5.72 million from six chains Cosmos EVM is a software module that extends a Cosmos blockchain with an Ethereum-compatible execution environment. A module in this sense is a finished code package that a chain team builds into its own blockchain instead of writing the function itself. The advantage is speed. The price is a shared dependency: a flaw in the module is a flaw in every chain that uses it. The vulnerability carries the identifier GHSA-7g4w-cg88-2cq2 and is classified as critical by Cosmos Labs itself. According to The Hacker News it was published without a CVE number, without a vulnerability classification and without a CVSS score. Affected are the versions below 0.6.2 as well as those from 0.7.0 up to but not including 0.7.2; the flaw was fixed in v0.6.2 and v0.7.2, which appeared on August 19, 2026. Not affected is the Cosmos Hub with its token ATOM, which runs without this module. If you are looking for the price page on it, you will find it in our ATOM price prediction. The risk of confusion is real, because the word Cosmos appears in the name of both things, and it explains part of last week's uncertainty. Balance reconciliation and overflow: how the Cosmos EVM gap works technically The flaw sits at the seam between two sets of books. A Cosmos blockchain keeps balances in the x/bank module, while the Ethereum environment keeps them in parallel in its own state database, the StateDB. Both have to show the same figure after every transaction, and that reconciliation is where things jammed. According to The Hacker News, the problem arises when a so-called vesting account delegates more than its freely available balance allows. A vesting account is an address whose tokens are released only on a schedule; part of the holding is locked, part is available. When writing back after the delegation, the code subtracted the full delegated amount from the smaller available amount, without checking whether the result could be positive at all. What follows is a classic of computer arithmetic.