Cosmos

A newly released onchain investigation alleges that part of the Cosmos ecosystem may have been developed by North Korean agents and attracted the FBI’s attention in 2023.
Part of Cosmos’ Liquid Staking Module (LSM) may have been built by North Korean developers, according to Cosmos ecosystem developer Jacob Gadikian, who shared the investigation in an Oct. 16 X <a data-ct-non-breakable="null" href="https://x.com/gadikian/status/1846608098792034690" rel="null" target="null" text="null" title="null">post</a>:
<blockquote>
 “It isn’t about their geography or ethnicity.&nbsp; The people who built the LSM are the world’s most skilled and prolific crypto thieves.”
</blockquote>
Investor concerns arose after the revelation, fearing that some of the developers might have come from the infamous <a data-ct-non-breakable="null" href="https://cointelegraph.com/top-people-in-crypto-and-blockchain-2023/lazarus-group" rel="null" target="null" text="null" title="null">Lazarus Group</a>, a cybercrime group with North Korean government affiliation credited for some of the biggest crypto hacks, including the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/axie-infinity-s-ronin-bridge-hacked-for-over-600m" rel="null" target="null" text="null" title="null">$600 million Ronin</a> bridge exploit.
Cosmos was previously unaware of the North Korean contribution to the LSM, according to Ethan Buchman, the co-founder of Cosmos, who wrote in an Oct. 18 X <a data-ct-non-breakable="null" href="https://x.com/buchmanster/status/1847266140881301763" rel="nofollow noopener" target="_blank" text="null" title="https://x.com/buchmanster/status/1847266140881301763">post</a>:
<blockquote>
 “Props to the teams coming together to line up these audits quickly. We’re also looking at ways to remove dependence on LSM completely. None of us were aware of the North Korean work on LSM, but working together to deal with it.”
</blockquote>
<figure>
 <img alt="Decentralization, North Korea, Developers, Cosmos, Staking" src="https://s3.cointelegraph.com/uploads/2024-10/0192b8ef-0311-7ede-b484-ea2b68249c00" title="">
 <figcaption style="text-align: center;">
 Cosmos co-founder response to North Korean connection. Source: Ethan Buchman
 </figcaption>
</figure>
The fact that malicious North Korean actors may be involved with Cosmos LSM code could present hidden vulnerabilities, like a secret back door in the ecosystem, according to Melody Chan, research lead at Redecentralise, a nonprofit advocating the sustainable development of <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/defi-a-comprehensive-guide-to-decentralized-finance" rel="null" target="null" text="null" title="null">decentralized finance (DeFi)</a>.
The research lead told Cointelegraph:
<blockquote>
 “The big fear is that these developers might add vulnerabilities, like backdoors or ways to hack the system. With the current issues in the LSM and the FBI’s warnings, it’s clear that thorough code audits are urgently needed.”
</blockquote>
Lazarus is among the most notorious groups of crypto hackers, first emerging in 2009 and <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-hackers-stolen-crypto" rel="null" target="null" text="null" title="null">stealing over $3 billion in crypto</a> assets in the six years leading up to 2023.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lazarus-group-laundered-200m-crypto-since-2020" rel="null" target="null" text="null" title="null">Lazarus Group laundered over $200M in hacked crypto since 2020</a>
<h2 id="cosmos-lsm-s-fate-could-be-decided-by-incoming-security-audits">Cosmos LSM’s fate could be decided by incoming security audits</h2>
While the possible North Korean connection is concerning, it doesn’t necessarily imply that the developers were affiliated with the Lazarus Group, according to Anndy Lian, author and intergovernmental blockchain expert.
Based on the current information, ties to the Lazarus Group are still just allegations, Lian told Cointelegraph. Still, he added:
<blockquote>
 “Should developers with connections to North Korea—especially those linked to military or state operations known for cyberattacks and cryptocurrency theft—be implicated, there is a potential risk of hidden vulnerabilities or backdoors in the code.”
</blockquote>
<figure>
 <img alt="Decentralization, North Korea, Developers, Cosmos, Staking" src="https://s3.cointelegraph.com/uploads/2024-10/0192b8ef-d427-76f6-938a-ea8ec2846888" title="">
 <figcaption style="text-align: center;">
 Incoming Cosmos LSM audits. Source: Informal Systems
 </figcaption>
</figure>
Two parallel audits will be conducted to tackle any potential vulnerabilities. The first one by OtterSec and Binary Builders, scheduled to begin next week, and the second one by Zellic, set to start in mid-November, <a data-ct-non-breakable="null" href="https://x.com/informalinc/status/1847260348929519778" rel="null" target="null" text="null" title="null">announced</a> core Cosmos contributor Informal Systems
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/winklevoss-backed-defi-platform-launches-6-9-m-investment-round" rel="null" target="null" text="null" title="null">Winklevoss-backed DeFi platform launches after $6.9M investment round</a>
<h2 id="core-cosmos-contributors-suggest-phased-removal-of-cosmos-lsm">Core Cosmos contributors suggest phased removal of Cosmos LSM</h2>
Following the reports, Informal Systems suggested a “phased removal” of the Cosmos LSM, which would be replaced by a new framework.
The new framework would benefit validators, voters and overall Cosmos governance, the Cosmos contributor firm wrote in an Oct. 22 X <a data-ct-non-breakable="null" href="https://x.com/informalinc/status/1848751173106602239" rel="null" target="null" text="null" title="null">post</a>:
<blockquote>
 “After a community vote to remove the LSM, there would be a 1-2 month grace period for LSM shareholders to un-tokenize and convert their shares to native delegations. The Cosmos Hub will then need to upgrade to remove the LSM, invalidating remaining tokenized shares and automatically converting them back to native delegations.”
</blockquote>
<figure>
 <img alt="Decentralization, North Korea, Developers, Cosmos, Staking" src="https://s3.cointelegraph.com/uploads/2024-10/0192b8f0-67b4-7d7a-838e-a465d67c5fb5" title="">
 <figcaption style="text-align: center;">
 Cosmos Hub, LSM removal plan. Source: Informal Systems&nbsp;
 </figcaption>
</figure>
The new framework would separate governance from block production, enabling users to delegate block production to one validator while assigning governance votes to different entities.
Cointelegraph has asked Cosmos for comment, but received no immediate reply.<iframe width="100%" height="315" src="https://www.youtube.com/embed/MQj9248C7Uc" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
Bitcoin conference and a bad trip to North Korea | Crypto Stories Ep. 10. Source: YouTube
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/" rel="null" target="null" text="null" title="null">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

Cosmos ecosystem rocked by North Korean developer allegations

Table of Contents

Cointelegraph

Other articles published on Oct 23, 2024

First Time Elon Musk and Mark Cuban Will Agree On Two Things Related to Ripple and XRP

Bitcoin Price Prediction: Bernstein Analyst Predicts BTC To Hit $200K BY 2025

Steam to add sales tax to market fees, initially affecting select US regions

AI memecoin millionaire Truth Terminal has sparked an AI boom in crypto

Japan’s Digital Future: Tamaki Proposes Crypto Tax Cuts and Digital Yen

Paxos Launches Yield Bearing Wrapped $USDL on Injective

Join our free newsletter for daily crypto updates!