Cosmos Labs has classified the issue as Critical, however the advisory is not accompanied by a CVE, weakness classification, or CVSS score. In the versions 0.6.2 and 0.7.2 patches, state-breaking changes were introduced, so affected chains were required to perform coordinated network upgrades. Cosmos Labs has advised operators that if they cannot complete an immediate upgrade, they should cease operations, rather than proceed with governance-based upgrades while remaining exposed. 

A vulnerability was reported by the company on April 25 through a bug bounty program. Following a failure by Cosmos Labs to reproduce the issue on networks using 18-decimal configurations, the team initially concluded that the issue did not pose a threat to funds on live networks. It turned out that assessment was incorrect as the team established on August 13 that the vulnerability affected Cosmos EVM chains regardless of their decimal configurations. 

After the flaw was discovered, Cosmos Labs developed a public silent-patch process, which was designed to address vulnerability that does not present a risk of fund loss on production networks. The patch was released on August 19, one day prior to the first reported exploit. It has since been revealed that several affected blockchains have halt their chains following successful attacks on their funds. KiiChain and TAC have halted their chains as a result, while MANTRA has temporarily closed its mainnet and later restarted it after the fix has been applied. 

A security incident was reported by MANTRA among the first networks. The team initially described the incident as a result of an upstream dependency, which led to a halt of the chain. The team said user balances were not impacted, while two wallets controlled by MANTRA were compromised. The vulnerable component was identified by MANTRA as the Cosmos EVM module and reported that version 8.4.0 had been released to address the issue, resulting in the normal block production process returning. 

In August, KiiChain confirmed a direct exploitation of the vulnerability. The attacker reportedly utilized the same technique 18 times, draining 148,326,583.15 KII before the network was halted at block 9,355,723 by validators. According to KiiChain, the vulnerability can only be found in the Cosmos EVM module rather than in its own chain-specific implementation of the Cosmos EVM module. This network has been suspended and is expected to resume via coordinated binary upgrades at a predetermined block height, with validators applying the new versions simultaneously. 

TAC also suspended its network at block 24,671,475 on August 22 after an attacker drained funds from a single account. The team attributed the vulnerability to the Cosmos EVM module instead of TAC-specific code. Cosmos Labs has informed affected teams that they should contact their security contact, and a more comprehensive incident report will be released once the situation has been resolved. The company has not disclosed what caused the vulnerability. 

This vulnerability is associated with the way Cosmos EVM reconciles Ethereum-style account balances with Cosmos SDK's x/bank module. The EVM tracks the balance of an account, and vesting accounts may also contain funds that remain locked. Staking functions are still capable of delegating locked funds. 

An underflow of balance could occur if a vesting account delegated more than its available spendable balance. In lieu of rejecting the transaction, the calculation wrapped the balance into an extremely large UINT256 value. Cosmos EVM was then able to interpret the altered balance as newly created funds during reconciliation. The same mechanism could also be used against another account. Attackers could transfer artificially inflated amounts to victims' accounts, resulting in the subsequent reconciliation process burning their legitimate balances. 

By creating vesting accounts without permission, the attack was successful. Using a contract deployed at a predetermined address, the attack was completed in a single transaction. This was a result of an underflow check introduced in May that was then backported to the release branches affected by the issue. The handling of locked balances has also been corrected, and a separate safeguard has restricted modifications to module accounts involving balance modifications. 

Along with the technical issue, Cosmos Labs' handling of the vulnerability has become a major concern. Cosmos Labs confirmed on August 13 that the issue affected Cosmos EVM networks regardless of their decimal configuration, however, a silent patch process was used to apply the patch. 

Shortly after the patched releases became available on August 19, a public pull request was made in Push Chain's Cosmos EVM fork, describing the vulnerability and its exploitation method. A less than 12-hour period later Cosmos Labs reported the first reported attack on MANTRA. It is believed that six networks have been exposed to the exploit.

On the basis of information provided by the affected chains, approximately $2.87 million worth of assets were traded through decentralized exchanges, while another $2.85 million was traded through centralized exchanges. The figures have not been independently audited. 

Cosmos Labs reports that 11 Cosmos EVM deployments that had not registered security contacts were discovered during the incident. The incident has also highlighted difficulties in reaching downstream operators. Due to the fact that there are over 115 public blockchains in the Cosmos ecosystem and no database of the networks that run its software, distributing urgent security updates remains a complex effort.