SagaEVM: Cosmos EVM ICS20 precompile bug let one balance be spent repeatedly

What happened

• 21 Jan 2026: about USD 7M in USDC withdrawn, bridged out and converted to ETH. Saga halted at block 6593800.
• Root cause per Cosmos advisory ASA-2026-002 (GHSA-54gx-3cgr-7mfm, critical, CVSS v4 9.3): incorrect state handling during nested EVM execution in the ICS20 precompile, so state changes in recursive calls were not reflected in the outer context and the same balance could be reused in one transaction. Code introduced upstream July 2024; fixed in cosmos/evm v0.6.0 (public March 2026). Fifteen chains ran affected code; one was exploited.
• Attribution: none. Saga found no validator, consensus or signer key compromise.
• Response: chain paused, attacker address blacklisting requested. Patches distributed privately to affected chains in mid-Feb.

Sources

• https://github.com/advisories/GHSA-54gx-3cgr-7mfm
• https://www.theblock.co/post/386638/sagaevm-suffers-exploit

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.