ON August 20‑25 attackers exploited an arithmetic overflow in the Cosmos EVM module to syphon roughly $2.9 million from six different blockchain networks, according to a security advisory from Cosmos Labs (GHSA-7g4w-cg88-2cq2). The theft was first spotted by on‑chain analysts who noticed abnormal balance spikes across several chains. Security researchers traced the losses (as reported by securityonline.info) to a flaw recorded as GHSA-7g4w-cg88-2cq2, which allows an attacker to inflate token balances before withdrawing real assets. The incident has prompted urgent calls for better validation logic in cross‑environment bridges.
The flaw stems from a mismatch between the Cosmos SDK’s account balance tracking and the Ethereum Virtual Machine’s StateDB, allowing an attacker to craft a transaction that triggers an integer overflow and temporarily inflates a token balance, which can then be withdrawn as real assets. The SDK uses a signed integer format while the EVM expects an unsigned 256‑bit value, so when a large number is added the result wraps around to a small positive number. This discrepancy lets the attacker submit a transfer that the EVM accepts as valid while the SDK records a negative or zero balance, opening the door to theft.
Because the overflow bypasses standard balance checks, the malicious transaction appears valid to the EVM while the underlying SDK records a negative or zero balance, enabling the drain. The vulnerability affected any chain that integrated the Cosmos EVM module prior to the patch, including but not limited to the six chains named in the advisory. Analysts estimate the total taken at roughly $2.87 million, spread across assets such as ATOM, USDC and various ERC‑20 tokens wrapped on the affected networks.
Although Cosmos Labs had been aware of the issue weeks before the attacks, the patch was not deployed in time, leaving the networks exposed. The theft was carried out by unidentified actors who moved the stolen funds across multiple exchanges, highlighting the speed with which such flaws can be monetized. A follow‑up piece by thehackernews.com (thehackernews.com) noted that the delay underscored a gap between vulnerability disclosure and remediation in fast‑moving blockchain projects.
In the aftermath, Cosmos Labs has begun notifying the affected chains, urging operators to upgrade to the latest EVM release that includes proper overflow mitigations, and has launched a review of its internal disclosure timelines to prevent similar delays. The advisory recommends that validators restart their nodes with the patched binary and re‑sync state to ensure consistency between the SDK and EVM layers. Chain operators are also advised to freeze any suspicious contracts pending a full audit.
Developers should audit their balance‑handling code for unchecked arithmetic operations, implement safe math libraries or language built‑ins that reject overflows, and enforce post‑transaction balance verification; chain operators must apply the patch promptly, monitor logs for abnormal balance spikes, and coordinate with forensic teams to trace any anomalous flows. By integrating these checks into routine CI pipelines and maintaining an up‑to‑date dependency inventory, projects can reduce the risk of similar exploits slipping through the cracks.