Cosmos Labs acknowledges faulty approval of the flaw responsible for a $5.7 million theft spanning six blockchain networks

Cosmos Labs has admitted to improperly approving a security vulnerability that led to a coordinated attack across six blockchain networks, resulting in $5.7 million in losses. The incident exposes critical gaps in how major blockchain infrastructure providers communicate and coordinate security patches with their ecosystem partners.

• MANTRA Chain lost $3.6 million in the attack, the largest single loss among six affected chains in the multi-chain exploit.
• Cosmos Labs released the security patch only 20 hours before attackers exploited the vulnerability across the networks.
• The patch lacked clear documentation identifying which specific vulnerability it was designed to address, hampering risk assessment.

• $5.7M Total losses across six blockchain networks hit in coordinated attack
• $3.6M Losses sustained by MANTRA Chain, largest single loss among affected chains
• 20 hours Time between patch release and attack commencement across networks
• 6 Total number of blockchain networks compromised in the broader attack

Cosmos Labs has acknowledged that it improperly cleared a security vulnerability that subsequently enabled a multi-chain attack resulting in $5.7 million in losses across six blockchain networks. MANTRA Chain, which sustained $3.6 million in damages from the incident, contended that Cosmos Labs released the patch addressing the flaw merely 20 hours prior to when the attack commenced. According to MANTRA Chain, the security update failed to explicitly identify which vulnerability it was designed to remediate.

Cosmos labs’ failure to document the patched vulnerability

The absence of clear documentation about which specific vulnerability a patch addresses represents a critical breakdown in security communication. When a security update is released without accompanying details, developers and security teams at dependent projects face significant challenges in determining whether the patch is urgent and whether their systems are affected. This ambiguity can lead to delayed patching, as teams may deprioritize updates when the nature and severity of addressed issues remain unclear.

Industry best practices call for security advisories to include technical details about the vulnerability, its potential impact, affected versions, and mitigation strategies. Clear identification of the CVE or internal vulnerability number allows projects to cross-reference the issue with other disclosures and assess their exposure systematically. The lack of such documentation in this incident appears to have left chains like MANTRA Chain scrambling to understand what had been fixed and whether urgent action was required.

This documentation gap is particularly problematic in the blockchain industry, where security vulnerabilities can expose digital assets worth substantial sums to immediate risk. Projects operating on the Cosmos network depend on receiving clear, actionable information from the core development team to prioritize their response efforts and allocate resources appropriately.

Compressed timeline between patch release and exploitation

The 20-hour window between patch release and the attack’s commencement raises serious questions about whether adequate time was provided for security teams to apply updates. A timeline this compressed suggests that coordination mechanisms between Cosmos Labs and downstream projects may be insufficient for the scale and interconnectedness of the ecosystem.

In the blockchain context, where nodes must be updated across distributed networks and consensus mechanisms must be maintained, 20 hours is a remarkably tight timeline. Network operators need time not only to assess patches but also to coordinate updates across validator sets, test changes in staging environments, and execute updates in ways that maintain network stability. The compressed timeline suggests either that the vulnerability was initially kept under embargo for insufficient duration, or that information about the vulnerability leaked before the patch was ready for widespread deployment.

Coordinating security patches across a network of independent validators and node operators typically requires substantially more lead time than 20 hours. Many projects schedule regular maintenance windows for infrastructure updates and may not be able to respond to emergency patches on such short notice without creating network disruption or stability concerns.

Systemic risks across interconnected Blockchain infrastructure

The Cosmos ecosystem comprises hundreds of blockchain projects ranging from specialized application chains to dedicated infrastructure networks. Built on the Cosmos SDK and utilizing the Tendermint consensus engine, many of these projects rely heavily on libraries, modules, and security updates distributed by Cosmos Labs. This interconnected architecture, while offering substantial benefits in terms of flexibility and efficiency, creates systemic risks where vulnerabilities in core infrastructure can cascade across multiple networks simultaneously.

The multi-chain nature of the attack demonstrates how interconnected modern blockchain ecosystems have become and how vulnerabilities in shared infrastructure can create systemic risks affecting multiple dependent networks. Unlike isolated blockchain systems, ecosystems like Cosmos introduce dependencies that can amplify the impact of security oversights across the entire network of connected chains.

The incident has prompted discussions within the Cosmos community about establishing more formal security coordination procedures, with projects increasingly recognizing that mature security practices are essential components of sustainable blockchain infrastructure. As blockchain technology continues to mature, organizations like Cosmos Labs face ongoing pressure to balance transparency with security, providing adequate warning to partners while not disclosing vulnerability details that could aid attackers.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.