Three blockchain networks built on the Cosmos ecosystem were forced to halt validator operations after attackers exploited a known vulnerability in the Cosmos EVM module — a plug-and-play component that gives Cosmos SDK chains compatibility with Ethereum’s Virtual Machine. The flaw, catalogued as ASA-2026-002, was first disclosed in March 2026 and affects the ICS20 precompile, a piece of code that handles cross-chain token transfers. The core problem is incorrect state handling during nested EVM execution, which allows an attacker to manipulate how the system tracks balances and ownership during complex transactions. Despite knowing about the issue months earlier, Cosmos Labs did not push all affected chains to patch before attackers moved.
The attacks hit Mantra, TAC, and KiiChain between August 20 and August 22. KiiChain confirmed that 148,326,583.15 KII tokens were drained across 18 separate attacks on August 22. Cosmos Labs has since contacted all chains running the vulnerable module and asked them to coordinate with validators to halt block production — a significant measure on decentralized proof-of-stake networks where halting requires collective agreement across node operators. Cosmos Labs says chains running Cosmos EVM version below v0.6.2 or v0.7.2 are at risk and should halt immediately until the patch is applied.