Cosmos Labs flags active security incident impacting chains running Cosmos EVM module

Cosmos Labs said on August 24 that it is responding to an active security incident targeting networks built with its Cosmos EVM module, a plug-and-play layer that enables Cosmos SDK chains to run Ethereum Virtual Machine (EVM)-compatible code. The firm urged affected validators to halt their networks and said a full incident report will be published once the situation is contained. The alert follows a string of Cosmos EVM-related incidents in 2026. In January, the SagaEVM exploit was estimated to have drained about $7 million. While 15 chains using the module were impacted, only one chain was ultimately exploited. More recently, MANTRA Chain suffered a breach between August 20 and 22, triggering a 30-hour shutdown before service resumed after emergency patches. TAC was also hit on August 22, where attackers leveraged vulnerabilities in the precompile layer to move funds without minting new tokens. Two days later, Cosmos Labs issued its ecosystem-wide warning, pointing to the possibility of a broader weakness affecting multiple chains that share the same codebase. Cosmos Labs indicated the latest activity may be linked to ASA2026002, a critical vulnerability disclosed in March 2026 involving the ICS20 precompile used for cross-chain token transfers in the Cosmos ecosystem. The issue stemmed from incorrect state handling during nested EVM execution, which could allow an attacker to influence how balances and ownership are tracked during complex transactions. A patch was developed and rolled out in March through a coordinated ecosystem effort. The return of exploit activity in August raises questions over whether the earlier fix was incomplete or whether new attack paths have emerged in related code. Cosmos Labs has not published a full list of affected chains or the total value at risk, and its advisory effectively calls for pausing block production until further guidance is provided.