Saga (SagaEVM) exploit on 2026-01-21 ($7M reported)
Exploit, 21 Jan 2026. Reported loss $7M. Last verified 4 Nov 2026.
notable
Reported loss
$7M
as reported by the sources
Recovered
-
nothing reported
Status
Unknown
updated 26 Oct 2026
Date
other
Summary
On 2026-01-21 the Saga EVM network was exploited through a vulnerability in the ICS20 precompile of the Cosmos EVM stack, where incorrect state handling in nested calls allowed the same token balance to be reused within one transaction, causing an estimated loss of approximately $7M according to the Cosmos Labs security advisory.
- Protocol
- Saga (SagaEVM)
- Type
- Exploit
- Reported loss
- $7,000,000 source: github.com ↗
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | January 21, 2026 | github.com ↗ |
| Amount (USD) | approximately $7M | github.com ↗ |
| Cause | incorrect state handling during nested EVM execution paths involving the ICS20 precompile | github.com ↗ |
Primary sources
- Cosmos Labs security advisory ASA-2026-002 (cosmos/evm GitHub), covering the Saga EVM exploit ↗ post-mortem · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram