Loading story…
A critical Cosmos EVM balance-reconciliation flaw, tracked as GHSA-7g4w-cg88-2cq2, was exploited to drain assets from six Cosmos-based chains. The bug allows an unchecked underflow in a vesting account’s delegated balance to wrap to roughly 2^256, corrupting reconciliation between EVM state and the Cosmos SDK x/bank module and enabling unauthorized minting or burning. Attackers reportedly sold about $5.72 million in affected assets through decentralized and centralized exchanges; KiiChain alone reported the theft of 148 million KII, valued at about $9.7 million at the cited price, while an attacker moved 2.99 billion TAC from a TAC account.
Cosmos Labs released fixes in Cosmos EVM v0.6.2 and v0.7.2 and urged operators of affected public chains to coordinate upgrades or halt block production, as no configuration-only mitigation exists. MANTRA resumed operations using a patched v8.4.0 binary, while TAC and KiiChain remained halted; KiiChain alleged that public availability of the state-breaking patch before private operator notification created an exploitable window and said two of three upstream defects were still unpatched. Blocking permissionless creation of vesting accounts removes the exploit precondition, but operators still need to deploy the patched releases.
See which actors are running it and whether you're in range.
14 events from the most recent confirmed update back to the earliest known activity.
Warden Protocol blocked vesting-account creation because vesting accounts were its only source of locked balances, removing a prerequisite for the exploit.
TAC halted at block 24,671,475 at 23:58 UTC after an attacker exploited a Cosmos EVM precompile-layer vulnerability and moved 2,985,651,403 TAC between accounts. TAC said the amount represented about 62% of circulating supply, while total supply was unchanged.
An attacker used the vesting-account technique against 18 KiiChain targets, draining 148 million KII, valued by KiiChain at about $9.7 million. KiiChain halted at block 9,355,723 at 22:50:58 UTC; it said 67.6 million KII was bridged to BNB Smart Chain and 64.6 million was sold for about 1.61 million BUSD.
MANTRA resumed block production around 05:30 UTC using a patched v8.4.0 binary. It said it had no indication that user, exchange, or partner funds were affected.
KiiChain alleged that Cosmos Labs did not notify affected chains of the public fix until this date, after the patched releases were already available.
The first reported exploitation of GHSA-7g4w-cg88-2cq2 targeted MANTRA at 19:06 UTC. MANTRA halted block production late that day after two MANTRA-managed wallets were affected.
A public pull request in Push Chain's Cosmos EVM fork described the vulnerability and exploitation path at 07:16 UTC, roughly eight hours after the patched releases were issued.
Cosmos Labs released Cosmos EVM v0.6.2 and v0.7.2, containing state-breaking security fixes for the critical balance-reconciliation flaw. KiiChain later alleged that the public release occurred without advance notification or a security advisory to downstream chains.
Cosmos Labs confirmed that the vulnerability affected Cosmos EVM chains regardless of decimal configuration, reversing its earlier assessment that live-network funds were not at risk on 18-decimal networks. The underflow-guard fix was also backported on this date.
The critical Cosmos EVM flaw was exploited against six blockchains over the period from August 20 through August 25. Cosmos Labs estimated attackers sold approximately $2.87 million in affected assets on decentralized exchanges and $2.85 million on centralized exchanges.
Cosmos Labs merged pull request #1176, adding a SubBalance underflow guard intended to prevent the vulnerable balance subtraction.
The vesting-account balance-reconciliation vulnerability later tracked as GHSA-7g4w-cg88-2cq2 was reported to Cosmos Labs through its bug bounty program.
An attacker stole roughly $7 million from Saga's EVM network through the ICS20 precompile. Cosmos Labs' ASA-2026-002 later attributed the issue to recursive-call state updates not being reflected in the outer execution context, enabling repeated spending in one transaction.
Cosmos Labs acknowledged an ongoing incident affecting Cosmos EVM-module users and advised chains to have validators halt if they could not immediately perform the required coordinated, state-breaking upgrade. It identified versions before 0.6.2 and versions 0.7.0 through before 0.7.2 as affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcethehackernews.com
Open sourcethedefiant.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
THORChain was exploited across Bitcoin, Ethereum, BNB Chain, and Base, with losses rising from an initial estimate of **$7.4 million** to more than **$10.7 million** after an Asgard vault was drained. The protocol paused trading after the attack, and community investigators published suspected theft addresses on Bitcoin and EVM-compatible networks. Separately, Alephium disclosed that its private Wormhole-fork TokenBridge was exploited on Ethereum and BNB Chain for about **$815,000** after an off-chain backend flaw let forged guardian messages pass through its four-guardian system, enabling the minting of **13.76 million** unbacked wrapped `ALPH` on Ethereum. New reporting tied the THORChain incident to a privately disclosed but allegedly unremediated proposer-forgery flaw in the Bifrost attestation system. Security firm **V12** said it warned THORChain about a critical fund-draining bug, but the protocol silently patched code, did not pay a bounty, and retired its bug bounty program; researchers said a May 6 fix intended to block proposer forgery failed automated testing and was never deployed before the exploit. In Alephium’s case, the project and Blockaid revised earlier claims of guardian key theft and said the root cause was forged malicious events or messages observed and signed because of a backend vulnerability; Alephium shut down the bridge, halted new transactions, and urged holders to pull liquidity from Uniswap and PancakeSwap while the attacker still controls the unbacked tokens.
Jun 29, 2026
THORChain disclosed that one of its six Asgard vaults was compromised, enabling unauthorized outbound transactions before the network halted signing activity. Loss estimates ranged from about **$10.7 million** to more than **$11 million**, with stolen assets taken across at least nine blockchains including **Bitcoin, Ethereum, BNB Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP**. Investigators said the attacker initially dispersed funds across multiple chains and later consolidated proceeds into a two-address cluster, while THORChain said automated detection helped stop additional transfers. The root cause remained under investigation, with THORChain examining possible issues in the `GG20` implementation layer as well as potential infrastructure or operational compromise affecting node operators. The protocol paused signing-related churn activity, delaying validator rotation and other operations, and asked operators to review infrastructure, key management, and Bifrost logs tied to the affected vault. TRM Labs said no actor had been attributed at publication time, but urged compliance teams to quickly screen counterparties and flag deposits linked to tagged addresses as the stolen funds continue to move.
Jun 29, 2026
Saga paused the **SagaEVM** chain after identifying a security incident involving a coordinated sequence of **contract deployments**, **cross-chain activity**, and **liquidity withdrawals** that resulted in nearly **$7 million** in assets being moved to Ethereum mainnet. Saga reported the impact was limited to the SagaEVM chainlets **Colt** and **Mustang**, while the **Saga SSC mainnet** and other chainlets remained operational; the company also stated there was **no validator compromise**, **no consensus failure**, and **no signer key leakage**, indicating the broader network remained structurally sound. Saga said it paused SagaEVM at block height `6593800` to prevent further impact while engineering and security teams validate blast radius using archive data and execution traces, harden affected components, and complete remediation before restart. Saga identified an exploiter wallet `0x2044697623afa31459642708c83f04ecef8c6ecb` and is coordinating with exchanges and bridges to **blacklist** the address and attempt recovery of funds (including **USDC, yUSD, ETH, and tBTC**); additional protections to deter similar attack patterns were reported as already implemented, with a fuller technical post-mortem planned after remediation.
Jul 12, 2026