Cosmos Labs says it mistakenly cleared the bug behind a $5.7 million six-chain hack

Cosmos Labs has acknowledged that a bug it previously reviewed and cleared was later tied to a $5.7 million exploit that spread across six chains, turning a triage error into a multi-network security incident.

What Cosmos Labs says went wrong

Cosmos Labs said the vulnerability behind the incident had been assessed and mistakenly cleared before it was weaponized, meaning the flaw was flagged internally but not treated as exploitable, according to the project’s post-mortem. For related coverage, see Ripple CEO says company considered shutting down after SEC lawsuit.

Because the bug was cleared rather than patched, no fix shipped ahead of the exploit, and the attacker was able to act on a weakness that the team already knew about but had deprioritized. The disclosed loss reached $5.7 million. For related coverage, see Aave Labs Releases Stable Vaults Infrastructure Solution.

The failure is a security-process breakdown, not a product problem: the gap sits between how the bug was rated during review and how it behaved once deployed in a live Cosmos EVM environment. For related coverage, see SEC Reviews Exotic ETFs Across Crypto, Leverage and Private Assets.

How the six-chain hack expanded the damage

The exploit did not stay contained to a single network. Because the flaw lived in a shared Cosmos EVM module, the same underlying weakness reappeared across six chains that inherited the affected code, which is what pushed the incident from a single-chain bug into a systemic event.

That shared-dependency pattern is the same one that earlier forced Cosmos Labs to urge EVM chains to halt after a shared bug drained three networks, underscoring how a common module turns one exploitable defect into repeated impact across every chain that runs it.

For interconnected Cosmos-based DeFi, the takeaway is that the exploit surface scales with code reuse: every chain importing the vulnerable module became a target, multiplying both the dollar losses and the operational cleanup across teams that never wrote the flawed code themselves.

What the incident means for audits, remediation, and user risk

One of the affected networks, MANTRA, halted its chain and published a full incident post-mortem detailing the response, according to its own disclosure. That mirrors the emergency stop MANTRA used when it paused after the Cosmos EVM module issue.

The core unresolved question is why an internally identified bug was downgraded to cleared, and what changes to Cosmos Labs’ review and monitoring process would catch a similar misclassification before deployment rather than after funds move.

For integrators and users, the practical risk is that an audit clearance is not the same as real-world safety: chains that depend on shared modules inherit both the code and its unpatched risk, so monitoring and rapid halt capability matter as much as the pre-launch review that missed the flaw.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.