Cosmos EVM Hack: $5.72M Drained After Bounty Warning Missed Cosmos Labs confirmed in a post-mortem published on August 28, 2026, that a critical flaw led to a Cosmos EVM hack draining roughly
Cosmos Labs confirmed in a post-mortem published on August 28, 2026, that a critical flaw led to a Cosmos EVM hack draining roughly $5.72 million across six blockchain networks between August 20 and August 25, 2026.
The most striking part of the disclosure is not the exploit itself but the timeline behind it: the underlying EVM vulnerability had been reported through the project's own bug bounty program back in April, months before attackers actually used it.
Labs said in its officialpost-mortem report that attackers exploited a balance-handling bug in the shared EVM module, the component that lets SDK chains run Ethereum-style smart contracts. Funds were moved out through two separate routes:
$2.87 million in assets bridged cross-chain and sold on a decentralized exchange (DEX).
$2.85 million sold through centralized exchanges (CEX), whose accounts are now frozen pending investigation,
Six networks affected in total, based on figures the company says came from the impacted chains themselves,
This crypto hack news comes amid a rough month for based chains, with the blockchain exploit adding to a string of security incidents across the ecosystem in August.
TheWu Blockchain post on X was among the first to summarize Labs' internal review, breaking down the fund split between DEX and CEX sales and noting that the affected versions were anything below v0.6.2 or v0.7.2. 
WuBlockchain also covered this news in the tweet, flagging that the vulnerability had earlier been graded as posing no threat to production funds.
According to the security advisory, the flaw was originally submitted through the bug bounty channel and misjudged as low risk.
Cosmos Labs' ownbug bounty disclosure policy states that any issue carrying network-wide risk should trigger private fix distribution before public release a step the team acknowledged it skipped this time.
Detail
Figure
Total funds affected
$5.72 million
Sold via DEX
$2.87 million
Sold via CEX (frozen)
$2.85 million
Networks affected
6 chains
Vulnerable versions
Below v0.6.2 / v0.7.2
Fix shipped
v0.6.2 release notes & v0.7.2 update
Labs confirmed the incident directly through an official X statement, where it said engineering teams were actively working with affected chains and that its grading and disclosure processes for critical vulnerabilities would be revised going forward.
For the wider Cosmos DeFi exploit conversation, the incident raises a pointed question: how many other shared-module bugs across interoperable chains are sitting in bug bounty queues, misclassified as low risk, while carrying the same production exposure this one did.
With crypto news today increasingly dominated by cross-chain infrastructure risk, the EVM hack could push other modular ecosystems to re-examine how they triage vulnerability reports before, not after, funds move.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets carry high risk, and figures related to this hack are based on statements from official sources and may be revised as the investigation continues. Readers should conduct their own research before making any financial decisions.
