Cosmos Labs warns of security incident affecting Cosmos EVM module users

Cosmos Labs disclosed on August 24 that an active security incident is targeting chains built with its Cosmos EVM module, a plug-and-play layer that gives Cosmos SDK chains compatibility with the Ethereum Virtual Machine. The team’s advice to affected validators was blunt: stop your networks. Cosmos Labs said it plans to release a full incident report once the situation is contained. A pattern of exploits in 2026 This isn’t the first time the Cosmos EVM module has been at the center of a security scare this year. In January 2026, the SagaEVM exploit drained an estimated $7 million. That attack affected 15 chains that used the module, though only one was ultimately exploited. The more immediate precursors, however, are even more troubling. MANTRA Chain experienced a breach between August 20 and 22, forcing a 30-hour halt before operations resumed after emergency patches were applied. TAC was hit on August 22 as well, with attackers exploiting precompile-layer vulnerabilities that allowed unauthorized fund transfers without needing to mint new tokens. Two days later, Cosmos Labs issued its ecosystem-wide warning. The timing suggests that either the MANTRA and TAC incidents revealed a...