Cosmos Labs urged EVM chains to halt operations after a shared bug reportedly drained three networks, warning validators and infrastructure operators about common code exposure across the Cosmos EVM stack.

What Cosmos Labs told EVM chains to do

Cosmos Labs advised EVM-compatible chains to halt after a security incident that reportedly drained three networks, according to reporting from crypto.news. The guidance was directed at chain operators and validators rather than end users.

The call to halt is a defensive containment measure: stopping block production can help prevent further exploitation while teams assess the extent of exposure. The Defiant reported that the shared nature of the bug is what turned a single-chain problem into a broader multi-network concern.

Cosmos Labs issued the guidance directly through its official channel on X.

Source: @cosmoslabs_io on X

Why the bug is described as shared

A shared bug means the same flaw existed across more than one deployment, pointing to a common component in the Cosmos EVM module that multiple chains inherited. That shared dependency is why the halt request extended beyond the three drained networks to other chains running similar code.

The exposure pattern follows from how the stack is built: Cosmos EVM was introduced in 2025 as a framework for deploying Ethereum-compatible chains within the Cosmos SDK ecosystem, so adopting teams inherit common core components rather than maintaining bespoke EVM implementations. Shared-dependency failures of this kind have precedent elsewhere, such as the July 2023 Vyper compiler bug that left multiple Curve pools exploitable because several deployments had been built with the same faulty compiler version.

MANTRA was among the operators to respond to the underlying module issue, having halted its chain over a Cosmos EVM module problem. Its status page tracks the chain's operational state during the disruption.

KiiChain also published guidance addressing the incident on its official channel, via a post on X. The fact that separate teams responded to the same underlying flaw is consistent with a shared codebase rather than isolated exploits.

What operators and users should watch next

The immediate risk is operational: chains running the affected module must decide whether to pause block production, and infrastructure providers must weigh whether to keep bridges and dApps online. Halting is intended to freeze the blast radius until a patch is available.

Users on affected or related chains should confirm the operational status of any network before transacting, and treat pauses on deposits, withdrawals, or bridge activity as expected containment rather than isolated outages. The precedent is similar to how other protocols have frozen products after exploits to limit further losses.

Coordinated patching across many independent chains also has precedent in the Cosmos ecosystem, where validators and core developers have previously deployed fixes for shared SDK and IBC vulnerabilities ahead of public disclosure, so that updates were in place before the flaws became widely known.

Key unknowns remain at publication: the total value drained, the specific contracts or module version affected, and the full list of chains carrying the vulnerable code. Recovery depends on a verified patch and coordinated restart conditions from the responsible teams.