Cosmos EVM Bug Exploited Across Six Chains Moving $5.72M
Cosmos (ATOM)
Editor:
Eugene Serbin
Cvj.ai reports that a critical Cosmos EVM vulnerability, initially deemed non-threatening, was exploited across six chains between August 20 and August 25, 2026. The bug, a balance-underflow in the StateDB, allowed attackers to wrap account balances to approximately 2^256 when vesting accounts delegated more than their spendable balance. This flaw enabled unauthorized fund transfers without requiring administrative access or compromising validator keys.
Cosmos Labs had received the bug report on April 25 but incorrectly judged it safe for production, leading to a silent patch process without a specific advisory. The main branch received the fix on May 15, but the patched versions v0.6.2 and v0.7.2 were not released until August 19 at 23:01 UTC. MANTRA Chain noted this left operators with roughly 20 hours to coordinate a state-breaking upgrade across the validator set.
The exploit moved approximately $2.87 million through decentralized exchanges and $2.85 million through centralized venues, totaling $5.72 million. MANTRA Chain separately reported a token loss of 720,923,967.99 MANTRA tokens, valued at about $3.6 million at the pre-incident price. The incident highlights the risks of silent patching and the narrow window for upgrading decentralized networks. No governance controls or multisig signers were compromised, confirming the issue was purely a software defect.
How the market reacted
Whalio's own Binance spot order flow for ATOM, measured when this story was written up on 30 August 2026. Not the outlet's figures.
ATOM is trading at $1.50 with a 1-hour buy ratio of 55.3%, indicating short-term buying pressure, while the 4-hour ratio sits at 48.1%, suggesting a slight shift toward selling in the immediate past. Over the last 24 hours, the buy ratio drops to 43.6%, showing that buying interest is fading over the longer timeframe. The 1-hour volume delta is positive at +$2,317, meaning recent trades have been slightly more aggressive on the buy side, but the 4-hour delta is negative at -$4,866. The 24-hour volume delta is -$112,269, and the Cumulative Volume Delta (CVD) closed at -$137,133, confirming that net selling pressure has dominated the day. Spot volume for the period was $881,440 across 8,981 trades, with net buying occurring in only 6 of the 24 hours.
The latest daily buy ratio of 44.7% sits at the 9th percentile of the last 322 days, against a median of 49.8% - among the weakest buying days it has had.
Twenty-four hours later
What ATOM did over the 23 hours after the story broke. The market moves for its own reasons; this is what happened, not what the story caused.
Was that an ordinary day?
The same Binance spot measurements for ATOM, averaged over the days leading up to the story.
Over the preceding week, ATOM experienced a 7-day average buy ratio of 51.3%, making today’s 24-hour ratio of 43.6% notably lower by 7.7 points. Volume on this day was 0.32x the weekly average, indicating a significantly quieter trading session compared to recent norms. The price has declined 4.8% over the past eight days, with a total volume delta of +$278,699 recorded for that period. This day is unusual for its low volume relative to the weekly baseline, despite the recent security news. The coin saw net buying on only 4 of the 7 days in the preceding week, contrasting with the brief 1-hour buying spike seen today.