Cosmos Labs has acknowledged that a vulnerability it had previously reviewed and cleared was later tied to a $5.7 million exploit that spread across six chains, turning a triage error into a multi-network security incident.

What Cosmos Labs says went wrong

According to the project's post-mortem, the vulnerability behind the incident had been assessed and mistakenly cleared before it was weaponized. In other words, the flaw had been flagged internally but was not treated as exploitable.

Because the bug was cleared rather than patched, no fix shipped ahead of the exploit, and the attacker was able to act on a weakness the team already knew about but had deprioritized. The disclosed loss reached $5.7 million, The Block reported.

The failure represents a security-process breakdown rather than a product problem: the gap lies between how the bug was rated during review and how it behaved once deployed in a live Cosmos EVM environment. Misjudging severity during triage is a recognized failure mode in security programs more broadly, where vulnerabilities judged low-risk or unreachable in review can turn out to be exploitable in production once an attacker finds a path the assessment missed.

How the six-chain hack expanded the damage

The exploit did not remain contained to a single network. Because the flaw lived in a shared Cosmos EVM module, the same underlying weakness reappeared across six chains that inherited the affected code — which pushed the incident from a single-chain bug into a systemic event.

That shared-dependency pattern is the same one that earlier forced Cosmos Labs to urge EVM chains to halt after a shared bug drained three networks, underscoring how a common module turns one exploitable defect into repeated impact across every chain that runs it.

For interconnected Cosmos-based DeFi, the exploit surface scales with code reuse: every chain importing the vulnerable module became a target, multiplying both the dollar losses and the operational cleanup across teams that never wrote the flawed code themselves. This contagion risk from shared dependencies is one reason ecosystem-wide coordination mechanisms — coordinated disclosures, shared security advisories, and the ability to rapidly push patches or halt chains — have become standard practice in multi-chain environments built on common codebases.

What the incident means for audits, remediation, and user risk

One of the affected networks, MANTRA, halted its chain and published a full incident post-mortem detailing the response, according to its own disclosure. That mirrors the emergency stop MANTRA used when it paused after the Cosmos EVM module issue.

The core unresolved question is why an internally identified bug was downgraded to cleared, and what changes to Cosmos Labs' review and monitoring process would catch a similar misclassification before deployment rather than after funds move. What to watch next is whether the post-mortem's process changes — and any follow-on patches across affected chains — are adopted quickly enough to restore confidence in shared-module security, and whether integrators revisit their own dependencies on the affected code.

For integrators and users, the practical risk is that an audit clearance is not the same as real-world safety: chains that depend on shared modules inherit both the code and its unpatched risk, so monitoring and rapid halt capability matter as much as the pre-launch review that missed the flaw.