TL;DR
- Cosmos Labs warned EVM-compatible networks running on its infrastructure to pause block production immediately following a security incident.
- The company did not identify the affected networks, did not confirm whether any funds were stolen, and did not specify whether the cause was an exploit, a bug, or a configuration failure.
- Twenty-four hours after the initial alert, the protocol had not published any technical details about the nature of the incident or a list of the compromised chains.
The modular blockchain network Cosmos issued a security alert directed at Ethereum Virtual Machine-compatible networks operating on its infrastructure.
Through its engineering and security teams, Cosmos Labs recommended that operators in contact with the company ask their validators to halt block production until the situation was brought under control. The exact nature of the incident, the chains involved, and whether any financial losses occurred were not confirmed at any point.
The measure is typically used to limit the exploitability of a vulnerability while development teams identify the root cause. In this case, the protocol did not confirm whether the incident originated from an active exploit, a software bug, or some other type of attack on the shared infrastructure.
An ongoing security incident has impacted users of the Cosmos EVM module. Cosmos Labs’ security and engineering teams have been proactively responding to this incident. We have advised the Cosmos EVM chains that are in contact with us to request that validators halt their chains.…
— Cosmos Labs (@cosmoslabs_io) August 24, 2026
24 Hours Later, Cosmos Offers No Answers
The most significant issue is that Cosmos EVM is not an independent, isolated network. It is a module that allows chains built on its SDK to support the Ethereum Virtual Machine and ETH-compatible tooling. The actual scope of the problem depends on which part of the infrastructure is affected and which networks are running the compromised version or configuration.
As of now, the company has not published a list of affected nodes or confirmed how many users were impacted. There is also no estimate of funds stolen or at risk, making it impossible to determine whether this was a preventive shutdown or whether concrete financial damage has already occurred.
Waiting for a Full Report
Twenty-four hours after the initial alert, Cosmos Labs has not published any technical report or made any public statement about the origin of the incident. The company only thanked the teams using its EVM for their quick response and confirmed that a full report will be published once the matter is resolved.
This situation exposed a risk inherent to modular blockchain architecture: when multiple independent networks share a software component, a failure in that component can require a coordinated response across several ecosystems. This does not necessarily mean that all networks in its ecosystem are vulnerable, as the impact depends on software versions, individual configurations, and how each chain integrated the module.
