Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

thehackernews.com Aug 29, 2026

Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Curated by Shubham · TechCapsules · Aug 29, 2026

AI-summarised brief · reviewed before publication

Cosmos Labs confirmed that a critical balance-handling vulnerability in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The flaw, designated GHSA-7g4w-cg88-2cq2, affects versions prior to 0.6.2 and 0.7.2. Although reported via bug bounty on April 25, Cosmos Labs initially assessed it as low risk, incorrectly believing it only impacted non-18-decimal networks. By August 13, the team acknowledged all chains were vulnerable. Despite this, the fix was released publicly via a silent patch process rather than through secure, private channels reserved for immediate fund risks. The technical error involves unchecked subtraction when vesting accounts delegate funds, causing balance underflows that allow attackers to mint or burn tokens. Affected chains must perform state-breaking coordinated upgrades or halt operations immediately to prevent further exploitation.

💡 Why It Matters

· The incident exposes a dangerous disconnect between Cosmos Labs’ internal risk assessment and its own emergency response protocols.
· By treating a confirmed, active exploit as a low-severity issue, the organization prioritized procedural consistency over user asset protection, undermining trust in its security governance.

Read full article on thehackernews.com

The Next Fintech Battle Is Over the Rails That Move Money Across…

The fintech industry is shifting its competitive focus from consumer-facing applications to the underlying infrastructure facilitating cross-border payments. While domestic transfers appear instantaneous, international transactions remain sluggish due to complex coordination among banks, payment processors, foreign-exchange providers, and local payout networks. These intermediaries operate on disparate schedules and data standards, necessitating prefunded liquidity in multiple markets and incurring significant intermediary fees. Consequently, the next major battleground involves stablecoins, instant-payment links, and tokenized bank money competing to rebuild this fragmented system. The objective is to eliminate friction caused by currency conversions and compliance checks, making international value transfer as seamless as domestic transactions. The winner of this infrastructure race may render the underlying technology invisible to users, fundamentally altering how global money movement is perceived and executed across borders.

💡 Control over payment infrastructure dictates the future of global commerce efficiency, shifting power from traditional banking intermediaries to technology providers capable of standardizing disparate systems. This transition threatens to dismantle legacy revenue models built on transaction friction and currency conversion spreads.

blockchain.news · Aug 27

Unifra to Discontinue Conflux (CFX) RPC Service by Sept. 15, 2026

Unifra announced it will cease providing its Conflux (CFX) eSpace RPC service on September 15, 2026. After that date the endpoint will stop responding, forcing developers, wallet operators and dApp teams to switch to other providers. The Conflux blockchain itself will remain operational, but the loss of Unifra’s infrastructure removes a widely used access point. Unifra suggested alternatives such as BlockPi, Validation Cloud, Tenderly and NOWNodes, and urged developers to update configurations, test queries and transactions, and add backup endpoints. The move reflects Unifra’s broader shift away from Conflux toward networks like Ethereum, Arbitrum and Polygon, where it continues to offer roll‑up‑as‑a‑service solutions. Migration must be completed before the hard deadline to avoid service interruptions for all affected users worldwide immediately.

💡 Developers now must diversify their node providers, accelerating the industry’s shift toward built‑in redundancy and reducing reliance on single‑point infrastructure.

quantumcomputingreport.com · Aug 27

Postquant Labs Launches QuipSwap Bridgeless Protocol for Quantum-Safe Cross-Chain Transactions

Postquant Labs has publicly launched QuipSwap, a trustless, bridgeless cross-chain swap protocol designed to eliminate traditional bridge vulnerabilities and mitigate quantum decryption risks. Developed alongside quip.network, the system removes centralized intermediaries, smart contract bridges, oracles, and wrapped assets, which have historically been targets in major decentralized finance exploits. QuipSwap utilizes a synchronized peer-to-peer atomic key exchange mechanism, allowing counterparties to trade directly via wallet access without third-party custody. The protocol’s core codebase underwent a formal security audit by Oak Security following a live demonstration at ETHDenver. Postquant Labs, led by CEO Colton Dillion and CTO Dr. Richard Carback, has also deployed beta quantum-resistant wallets across Bitcoin, Ethereum, and Solana. These wallets enable users to retain native assets on existing chains while interacting with post-quantum computing workflows, addressing the threat quantum computers pose to legacy public-key signatures like ECDSA.

💡 By removing wrapped assets and oracles, QuipSwap eliminates the centralized storage points that have fueled billions in DeFi losses. This architecture directly counters the looming threat of quantum decryption attacks on legacy blockchain signatures.

thehackernews.com · Aug 27

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Threat actors tied to Dark Caracal with medium confidence deployed a new Go‑based malware framework, GoCaracal, in a June 2026 intrusion of an unnamed communications firm in Venezuela. The lightweight profile offers remote shell access, encrypted C2, payload execution and shellcode injection, while the extended profile adds browser data theft, keylogging, WebRTC remote desktop, SOCKS5 proxying and persistence functions. After initial C2 failures, the extended profile queries a public Ethereum JSON‑RPC endpoint with an eth_getStorageAt request to retrieve a replacement C2 address stored in a smart contract, then resumes off‑chain communication. This on‑chain fallback lets operators change the C2 address without updating the binary. Arctic Wolf released YARA rules, IoCs and noted similar activity across Latin America, though the exact victim count remains unknown.

💡 Leveraging a public Ethereum contract as a dynamic C2 fallback gives attackers a resilient, low‑cost way to re‑point malware without redeployment, complicating detection and takedown efforts.

thequantuminsider.com · Aug 27

StarkWare Researcher Demonstrates Quantum-Resistant Bitcoin Transaction

StarkWare researcher Avihu Levy demonstrated a quantum‑resistant Bitcoin transaction on the mainnet. The technique uses signature‑grinding to hide public‑key data while a transaction sits in the mempool, adding a quantum‑safe layer without changing Bitcoin’s cryptography. Because the format is non‑standard, the transaction was submitted through MARA’s Slipstream service, as nodes do not relay it. Levy, StarkWare’s first employee and head of applications, previously published a theoretical post on the method and now proves it works in practice. The execution challenges the view that only a protocol‑level fork can protect Bitcoin from future quantum attacks and strengthens calls for a soft‑fork upgrade. StarkWare released its detailed quantum roadmap in June, and CEO Eli Ben‑Sasson called the result a “lifeboat” for Bitcoin.

💡 By proving a practical quantum‑safe transaction without a fork, the work gives Bitcoin holders immediate protection options and pressures developers to adopt similar upgrades before quantum computers become viable.

techcabal.com · Aug 26

Peter Otobong: The software engineer who learnt to code on a ‘borrowed’…

Peter Otoboo ng, a Nigerian software engineer, co‑founded Fraqtion Finance to create a platform that would let investors pool capital for cross‑border trade, such as a Chinese firm purchasing Nigerian lithium. The team built a functional blockchain‑based system, but the venture stalled when non‑technical hurdles emerged: licensing, regulatory approval, capital sourcing, and acceptance by financial institutions proved insurmountable. Otoboo ng reflects that the project’s failure taught him that technology’s success depends more on the surrounding legal and business ecosystem than on code quality. He now prioritises assessing whether a solution can operate within existing frameworks, a shift that has guided his work on African tech communities, financial infrastructure, and blockchain applications.

💡 Otoboo ng’s experience underscores that fintech innovations in emerging markets must navigate complex regulatory and institutional landscapes before they can scale.