Cosmos EVM chains told to halt as security incident widens

Validators running chains built on the Cosmos EVM module are being asked to halt their networks as @cosmoslabs_io confirms its security teams are responding to an ongoing incident. A full incident report has been promised once the situation is resolved.

A Shared Component, A Widening Problem

The warning follows a disruption at MANTRA, a Cosmos-based real-world asset (RWA) chain, which stopped producing blocks late on August 20 UTC after an attacker exploited a vulnerability in an upstream software dependency. The halt froze all transactions, bridge operations, and public network endpoints. The team confirmed no user funds were exploited and that the incident affected two company-managed wallet addresses.

Notably, Cosmos EVM published an update on August 19 — two days before MANTRA halted — flagging important security fixes and urging all chains to upgrade immediately via a coordinated upgrade. No root cause for the August incident has been published, and Cosmos Labs describes it as ongoing.

For context, the Cosmos EVM module was at the center of a separate, resolved flaw earlier this year. In January, an attacker drained roughly $7 million from the Saga EVM network through a bug in the ICS20 precompile, a component that allows EVM smart contracts to initiate cross-chain token transfers via the Inter-Blockchain Communication (IBC) protocol. That flaw involved state changes during recursive calls not being reflected in the outer execution context, which allowed the same token balance to be spent more than once. Cosmos Labs identified 15 chains running the affected code, and a permanent fix was included in v0.6.0 of the Cosmos EVM, published in March 2026, per the ASA-2026-002 advisory. Whether the August incident involves the same component has not been confirmed.

MANTRA Back Online, Questions Remain

MANTRA resumed block production around 05:30 UTC on August 22 after a coordinated validator restart on version 8.4.0, which patched the flaw. The team said user balances were not altered and there was no rollback between the halt and the resumption.

Following the halt announcement, MANTRA's native token $OM dropped from approximately $0.005060 to an all-time low of $0.004126, a decline of around 18.5%, according to CoinGecko data. Trading volume surged by approximately 600% to roughly $24 million. The token later partially recovered toward $0.0044 but remained lower over the following 24 hours.

MANTRA has not confirmed which component was exploited or which version of the Cosmos EVM stack its mainnet was running at the time of the attack. A full post-mortem is expected once the network is stable.

Sources:
Cosmos Labs Security Advisory ASA-2026-002 (GitHub)
CoinDesk: MANTRA Token Plunges 18% to Record Low as Blockchain Halts After Exploit
CoinPaprika: MANTRA Freezes Its Chain and Falls to a Record Low After Exploit