Cosmos Labs disclosed on August 28 that attackers exploited a critical flaw in the shared Cosmos EVM module to drain funds from six blockchains between August 20 and 25, stealing an estimated 5.72 million dollars combined across decentralized and centralized exchanges. The flaw let an attacker chain a balance underflow and a balance overflow in a single transaction to extract tokens from vesting accounts without changing the total token supply, evading the checks that would normally flag a mint of new value.
The story is less about the exploit chain than the decision that preceded it. A researcher reported the underlying bug through Cosmos Labs’ bug bounty program back in April. The team tested it against production style configurations, could not reproduce it on 18 decimal networks, and concluded it only affected non-standard configurations, none of which were running in production. On that assessment, Cosmos Labs routed the fix through its silent, public patch process rather than private, coordinated disclosure to affected chains. By mid-August, new reports from independent researchers showed every Cosmos EVM chain was exposed regardless of decimal configuration, but Cosmos Labs judged the patch already public and unexploited, so it stuck with the silent process rather than switching to private distribution.
The original insight is not that Cosmos Labs got the severity wrong once. The same misjudgment survived a second review after the bug’s scope had already expanded, because escalating severity mid-triage was weaker than classifying it at intake. Cosmos Labs has committed to auditing how it spots cases where a flaw’s real scope exceeds the original report. For any bug bounty program, the lesson travels beyond blockchain: a severity call made on a narrow reproduction should expire the moment new reports change what is reproducible. Related reading: CVSS 10.0 Doesn’t Tell You What to Patch First and Same Severity Score, Different Deadline Now.
Source: Cosmos Labs post-mortem
