Cosmos Hub’s LSM: North Korean Development Raises Security Concerns
Cosmos Hub, a prominent decentralized project, finds itself embroiled in controversy amidst revelations that the development of its Liquid Staking Module (LSM) may have involved specialists from North Korea. Previously hailed as a significant advancement, the LSM allows participants to engage in financial operations without relinquishing their staking rewards. However, concerns have arisen regarding potential vulnerabilities embedded within the module, which could enable malicious actors to circumvent punitive measures.
Reports indicate that the development of the LSM commenced in August 2021 under the leadership of Iqlusion, a company helmed by Zaki Manian. Contributors to the project included individuals such as Jun Kai and Sarawut Sanit, whose involvement has now become a source of contention within the community. In July 2022, an audit conducted by Oak Security uncovered critical vulnerabilities within the module, but these were addressed by the same developers who initially created them. Despite these concerns, the module progressed, culminating in its integration into the Cosmos Hub in September 2023.
Insider accounts suggest that Manian received an FBI warning in March 2023 regarding the potential involvement of North Korean specialists, but failed to disclose this information to the community. Consequently, vulnerable code was incorporated into a critical component of the project, jeopardizing the security of the entire ecosystem. In October 2024, Cosmos co-founder Jae Kwon released information exposing the uncertainties and risks associated with the LSM. He argued that these vulnerabilities could endanger all assets denominated in ATOM, urging immediate audits and a prohibition on the use of “insecure protocols.”
The decentralized project’s community is now divided. While some demand a comprehensive audit and open discourse regarding the LSM, others fear such intervention could impede the project’s progress. Meanwhile, certain developers are contemplating their departure, apprehensive about the potential repercussions for their reputations and the risks associated with utilizing potentially compromised software.
