# Cosmos Labs Says a Flaw It Rated Low in March Was Used to Steal Nearly $6 Million Across Six Chains

The bug let a token transfer execute while the ledger recorded no movement, allowing the same balance to be spent more than once, and MANTRA says none of the stolen tokens have been recovered.

- Published: 2026-08-29T05:48:58.855Z
- Canonical: https://polylog.news/crypto/2026-08-29/cosmos-labs-says-a-flaw-it-rated-low-in-march-was-used-to-st
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/cosmos-misjudged-a-critical-bug-for-4-months-before-hackers-stole-nearly-6-million-across-6-chains/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/9ecac27cca0d52e23da80c2804f7b9912b352cbb)

Cosmos Labs has acknowledged that a defect its engineers triaged as low severity in March was later used to drain funds from six networks that share the same Cosmos EVM module. The total taken is [just under $6 million, spread across chains including MANTRA, TAC and KiiChain](https://cryptoslate.com/cosmos-misjudged-a-critical-bug-for-4-months-before-hackers-stole-nearly-6-million-across-6-chains/).

The root cause was an accounting mismatch in the ICS20 precompile, the component that handles token transfers under the Inter-Blockchain Communication (IBC) framework. Under certain nested calls, the transfer executed while the state record showed that no tokens had moved. That gap let an attacker spend the same balance repeatedly. The vector was neither an oracle manipulation nor a stolen key. It was a state-accounting bug in shared infrastructure that many independent chains inherit without auditing it themselves.

The timing is the part the ecosystem is arguing about. An upstream fix reached release branches only hours before the incidents began, and MANTRA halted its chain for roughly 30 hours between August 20 and 22 while emergency patches were applied. MANTRA has valued the tokens taken from it at about $3.6 million using the pre-incident price and says none have been recovered. Analysts tracking the stolen funds estimate roughly $2.87 million was converted through decentralized exchanges and about $2.85 million through centralized venues, which means part of the proceeds passed through platforms that can freeze balances if they choose to act.

Cosmos Labs says it is revising its security triage and disclosure process after learning the true blast radius of the flaw shortly before the attacks. The wider point is structural. A single module maintained by one team sits under many sovereign chains, and the severity rating assigned by that team effectively sets the patch urgency for all of them. The public incident library maintained by DeFiHackLabs, which [reconciled its running count past 862 logged incidents this week](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/9ecac27cca0d52e23da80c2804f7b9912b352cbb), continues to fill with cases of this shape.

## What this means

Application-specific chains sold sovereignty, but they buy their transfer logic from a common upstream repository, so one team's severity rating decides how fast dozens of validator sets patch. The exposed parties are holders of tokens on small Cosmos EVM chains, whose losses are concentrated and unlikely to be reimbursed, and the validators who must halt production to apply fixes. For the modular-chain thesis, the cost is credibility: shared code means correlated failure, and the market prices correlated failure into the tokens of every chain in the family, not just the ones drained.

## What to watch

- Whether Cosmos Labs publishes a revised triage and embargo policy with defined severity criteria, since the dispute here is about classification, not about the existence of a patch.
- Whether the centralized exchanges that processed roughly half the proceeds freeze or return any funds, which would show how much of on-chain theft is now reversible in practice.
- Whether other chains running the Cosmos EVM module disclose losses, because the count of affected networks has already risen from three to six.