Cosmos EVM flaw exploited across blockchains sharing the same vulnerable code

Cosmos Labs warned that attackers are actively exploiting a flaw in its Cosmos EVM module, the component that gives Cosmos blockchains Ethereum compatibility, and urged affected chains to halt their validators. The bug lies in how the module handles state during nested transactions, letting an attacker manipulate balance and ownership tracking to move funds without authorization. Because many independent chains share the same module code, the weakness is systemic: separate chains were hit in the days before the ecosystem-wide warning, suggesting attackers generalized one exploit across the shared codebase. A patch existed from earlier in the year, but new exploitation shows the risk persists. It echoes supply-chain risk applied to blockchain infrastructure.

Check

Operators of chains built on the Cosmos EVM module should follow Cosmos Labs' guidance, apply the latest patched module, and pause validators if advised until confirmed safe.

Affected

Blockchains built on the vulnerable Cosmos EVM module; incorrect state handling during nested execution lets attackers manipulate balances and ownership to steal funds, and shared code exposes many chains at once.

Fix

Update to the patched Cosmos EVM module, monitor for abnormal precompile calls and unauthorized transfers, coordinate with the ecosystem on halts, and recognize shared blockchain modules concentrate risk across every chain.