Cosmos Labs warns of security incident affecting Cosmos EVM module users

Multiple chains urged to halt operations as the shared EVM compatibility layer faces a fresh wave of exploits following earlier breaches this year

Cosmos Labs disclosed on August 24 that an active security incident is targeting chains built with its Cosmos EVM module, a plug-and-play layer that gives Cosmos SDK chains compatibility with the Ethereum Virtual Machine. The team’s advice to affected validators was blunt: stop your networks.

Cosmos Labs said it plans to release a full incident report once the situation is contained.

Cosmos Labs is responding to an ongoing security incident involving users of its Cosmos EVM module and has urged affected Cosmos EVM chains to halt their networks. The company said its security and engineering teams are actively working on the incident.

The scope and nature of the issue remain unclear. A detailed incident report will be released after the situation is resolved, as noted by the team.

The Cosmos EVM ecosystem has faced several security incidents in 2026. The first major incident came in January, when an exploit involving the SagaEVM implementation caused $7 million in losses.

Cosmos Labs identified 15 chains running code containing the relevant vulnerability, although six had not enabled the affected feature. One chain was exploited, while the others reportedly mitigated the issue before attackers could act.

The ecosystem saw further disruption in August. MANTRA Chain halted block production for roughly 30 hours following an incident involving its Cosmos EVM module. MANTRA said two wallet addresses it managed were affected and that no user funds were exploited. The chain resumed operations on Aug. 22 after deploying a patch.

TAC also halted its chain on Aug. 22 after reporting an exploited vulnerability affecting its Cosmos-based EVM environment and token supply.