Cosmos Labs urges EVM chains to halt after shared bug drains three networks

What Cosmos Labs told EVM chains to do

Cosmos Labs advised EVM-compatible chains to halt after a security incident that reportedly drained three networks, according to reporting from crypto.news. The guidance was directed at chain operators and validators rather than end users. For related coverage, see Aave Labs Releases Stable Vaults Infrastructure Solution.

The call to halt is a defensive containment measure: stopping block production prevents further exploitation while teams assess exposure. The Defiant reported that the shared nature of the bug is what escalated a single-chain problem into a multi-network concern. For related coverage, see Artificial Intelligence Summit –Philippines 2026.

Cosmos Labs issued the guidance directly through its official channel on X.

Source: @cosmoslabs_io on X

Why the bug is described as shared

A shared bug means the same flaw existed across more than one deployment, pointing to a common component in the Cosmos EVM module that multiple chains inherited. That shared dependency is why the halt request extended beyond the three drained networks to other chains running similar code. For related coverage, see Artificial Intelligence Summit –Malaysia 2026.

MANTRA was among the operators to respond to the underlying module issue, having halted its chain over a Cosmos EVM module problem. Its status page tracks the chain’s operational state during the disruption.

KiiChain also published guidance addressing the incident on its official channel, via a post on X. The pattern of separate teams responding to the same underlying flaw is consistent with a shared codebase rather than isolated exploits.

What operators and users should watch next

The immediate risk lens is operational: chains running the affected module face decisions on whether to pause block production, and infrastructure providers must weigh whether to keep bridges and dApps online. Halting is intended to freeze the blast radius until a patch is available.

Users on affected or related chains should confirm the operational status of any network before transacting, and treat pauses on deposits, withdrawals, or bridge activity as expected containment rather than isolated outages. The precedent mirrors how other protocols have frozen products after exploits to limit further losses.

Key unknowns remain at publication: the total value drained, the specific contracts or module version affected, and the full list of chains carrying the vulnerable code. Recovery depends on a verified patch and coordinated restart conditions from the responsible teams.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.