Cosmos Labs says it wrongly cleared a bug that led to $5.7M six-chain hack
Security & Exploits ·
The team behind Cosmos infrastructure has acknowledged that a vulnerability first flagged in April was mistakenly marked as resolved, allowing attackers to later drain funds across six separate chains.
Cosmos Labs confirmed that a Cosmos EVM bug, reported by researchers in April, was wrongly cleared before it went on to enable thefts totaling $5.7M, according to The Block. The flaw sat in the EVM compatibility layer that lets Cosmos SDK chains run Ethereum-style smart contracts, a feature meant to widen the ecosystem's reach beyond its native appchain design.
The exploit's impact was not evenly distributed. Within the cluster of affected chains, MANTRA Chain alone lost $3.6M, and that loss occurred just 20 hours after a patch intended to fix the issue had already been applied, indicating the initial remediation did not close the hole attackers ultimately used.
The incident sits alongside a string of other security and infrastructure moves across the Cosmos ecosystem in recent months. Cosmos SDK v0.54.4 shipped state-breaking security fixes and urged chains to coordinate upgrades immediately, while a separate 0-day vulnerability in the Cosmos consensus layer, rated CVSS 7.1 and capable of stalling nodes during block synchronization, was disclosed by security researcher Doyeon Park in April. Cosmos Labs has also been consolidating core infrastructure, acquiring Mintscan and centralizing it under a new Korea unit that stewards Skip:Go, IBC Eureka, and the Hub roadmap, a move some have flagged as raising ecosystem concentration risk.
The EVM layer at the center of this exploit is part of the broader interoperability push that includes IBC and IBC Eureka, the protocol extending Cosmos connectivity to Ethereum and other ecosystems, as outlined in Cosmos, Explained. That same push toward broader compatibility appears to have introduced the attack surface exploited here, since expanding smart-contract support across chains built on shared code also propagates any flaw in that code across all of them.
What remains unclear is why the April disclosure was treated as resolved when it was not, and whether the patch applied before the MANTRA Chain loss addressed only part of the underlying issue. It is also not yet known how the remaining chains among the six affected divided the balance of the $5.7M, or what further coordinated upgrades, beyond the SDK v0.54.4 fixes, Cosmos Labs plans to require of dependent chains going forward.