Cosmos Labs has confirmed an active security incident affecting users of the Cosmos EVM module, prompting an emergency recommendation for affected networks to halt validator operations while engineers investigate. The warning targets chains using Cosmos EVM infrastructure rather than the Cosmos Hub itself, reflecting the risk created when multiple independent networks share the same upstream software components.
In its official security alert, Cosmos Labs said its security and engineering teams are actively responding and have advised Cosmos EVM chains already in contact with the organization to request validator halts. The precise vulnerability, number of affected networks and total financial impact have not yet been publicly disclosed, making broader conclusions premature until the investigation is complete.
An ongoing security incident has impacted users of the Cosmos EVM module. Cosmos Labs’ security and engineering teams have been proactively responding to this incident. We have advised the Cosmos EVM chains that are in contact with us to request that validators halt their chains.…
— Cosmos Labs (@cosmoslabs_io) August 24, 2026
Shared EVM Infrastructure Creates a Multi-Chain Risk
Cosmos EVM provides Ethereum compatibility to blockchains built with the Cosmos SDK, allowing developers to deploy Solidity contracts and use familiar Ethereum tooling while retaining Cosmos-native functionality. A vulnerability inside that shared module can potentially affect multiple chains implementing the same component, even though those networks maintain separate validators, governance systems and application ecosystems.
That shared dependency explains why Cosmos Labs recommended coordinated validator shutdowns rather than waiting for individual chains to observe suspicious activity. Halting block production can prevent additional state changes while developers determine whether deployed configurations are vulnerable and prepare appropriate fixes, although it also temporarily interrupts transactions and applications on the affected networks.
The current incident should not automatically be identified with an earlier Cosmos EVM vulnerability disclosed in March. Cosmos Labs’ official GitHub security advisory ASA-2026-002 documented a critical flaw in the ICS20 precompile involving incorrect state handling during nested EVM execution. That earlier issue could allow the same token balance to be reused within a single transaction and was permanently patched in Cosmos EVM v0.6.0.
The March advisory identified 15 chains running code containing the affected component, although six had not enabled it and most others implemented mitigations before exploitation. One network suffered approximately $7 million in losses before remediation. Cosmos Labs said chains running v0.6.0 or with the ICS20 precompile disabled were protected from that specific vulnerability.
Current Root Cause Remains Undisclosed
The existence of that earlier flaw provides important context but does not prove that the August incident follows the same attack path. Cosmos Labs has not publicly confirmed that the current event involves ICS20, nested execution or any previously disclosed vulnerability, so recent incidents involving Cosmos-EVM-based networks should not be automatically grouped under one technical cause.
The organization plans to publish a complete incident report after containment and continues directing security questions to [email protected], the same contact listed in its official Cosmos EVM security policy. That post-mortem will be critical for determining which versions and configurations were exposed, whether patches were already available, and how broadly the incident propagated across the ecosystem.
For node operators, the immediate priority is containment rather than speculation. The current advisory demonstrates how a vulnerability in reusable blockchain infrastructure can become an ecosystem-wide operational issue even when individual chains maintain independent consensus, making dependency management and coordinated disclosure central to Cosmos EVM security.