Maintainers Knew Every Cosmos EVM Chain Was Vulnerable Before Flaw Was Exploited

A recently disclosed security weakness in the Cosmos Ethereum Virtual Machine (EVM) implementation has been actively exploited in the wild, according to reporting from The Hacker News. Cosmos EVM is a compatibility layer that allows blockchains built on the Cosmos network to run smart contracts originally written for Ethereum, the second largest blockchain platform. A smart contract is a self-executing program stored on a blockchain that automatically carries out its terms when predefined conditions are met. The EVM is the part of Ethereum that executes those programs, and Cosmos EVM ports that capability to the interconnected Cosmos ecosystem, where many independent blockchains communicate with each other.

What makes this incident especially concerning is that Cosmos Labs, the organization that leads development of the Cosmos ecosystem, reportedly knew that every blockchain running this particular EVM implementation was vulnerable before attackers began exploiting the flaw. In other words, the vulnerability was not an unknown zero-day (a flaw that the vendor has not yet discovered or patched). Instead, it was a known issue that had not been fully remediated across the affected chains before malicious actors moved in. This kind of window between public awareness of a vulnerability and widespread patching is a common period of risk in any software ecosystem, not just blockchains. Website owners and IT teams face the same challenge with content management systems, server software and cloud services.

The exact technical details of the vulnerability have not been released in full, but the report indicates that the flaw resided in the Cosmos EVM layer itself, meaning any blockchain that integrated this code could be impacted regardless of its own native security measures. Exploitation could allow attackers to manipulate smart contract execution, drain funds, or disrupt transaction processing, depending on the nature of the weakness. For organizations that operate blockchain nodes or host applications that interact with Cosmos-based chains, this means an urgent need to verify which version of the Cosmos EVM they are running and whether a patch has been applied.

Because Cosmos is designed as a network of independent but interoperable blockchains, a vulnerability in a shared component such as the EVM layer can have broad ripple effects. Each blockchain operator is responsible for updating its own nodes, but coordination across many teams often leads to delays. This incident highlights why security researchers and vendors sometimes delay public disclosure until a fix is ready. In this case, however, the knowledge of vulnerability apparently predated the exploitation, raising questions about patch distribution and update timelines.

For ordinary website owners and internet users, this story may seem far removed from daily operations. However, the underlying lesson applies to all software: known vulnerabilities left unpatched are the most common entry point for attackers. Websites built on WordPress, for example, frequently fall victim to exploits that target plugins with known flaws simply because site owners did not apply updates. The same principle applies to blockchain-based services, DNS infrastructure, and cloud platforms. Staying informed and applying fixes promptly remains the most effective defense.

For teams managing infrastructure that relies on third-party components, AEU-I offers security-first IT, infrastructure and consulting to help identify exposure to known flaws before attackers do.