Cosmos: Developer linked to North Korea went unnoticed for 2 years

• Cosmos beefs up security after North Korean agent infiltrates
• Cosmos SDK review found no active malicious code
• Double Reward Program Encourages Community Auditing

Interchain Labs (ICL), the developer of the Cosmos ecosystem’s core stack, has confirmed that a former employee hired by former maintainers contributed code to the project’s official repositories between 2022 and 2024. The individual was later identified as an agent linked to North Korea.

The technical investigation was supported by the Security Alliance and Asymmetric Research, which evaluated the cosmos/IAVL and cosmos/cosmos-sdk repositories. The analysis indicated that the code snippets submitted by the agent were mostly deprecated or removed after the Cosmos SDK v2 was discontinued. Independent audits also found no remaining risks or vulnerabilities.

The GitHub account associated with the contributor has been identified as “cool-develope.” In response, ICL has doubled the bounty offered in its HackerOne program over the next month, encouraging discovery of potential security flaws linked to the account.

According to Interchain Labs, the individual worked as a contractor for third-party vendors until November 2024, before development was centralized at ICL itself. After the transition, new security and screening protocols revealed the agent’s history, and he attempted to return to the project but was promptly rejected.

Since February, ICL has taken a series of enforcement measures, including revoking old access, revalidating credentials, and resetting audit controls. “Transparency and security are our top priorities in the Cosmos ecosystem,” said Barry Plunkett, co-CEO of Interchain Labs.

Asymmetric Research CEO Jonathan Claudius stressed that “open source ecosystems require proactive and continuous security.” He noted that the exposure of the case serves as a lesson for other Web3 communities.

This isn’t the first time Cosmos has dealt with infiltration. In October, co-founder Jae Kwon warned of the presence of North Korean agents in the development of the liquid staking module. At the time, he accused the company Iqlusion of negligence, mentioning that the developers continued to work even after an audit identified vulnerabilities.

Stride and I rewrote the entire thing.

— zmanian.eth (@zmanian) October 2, 2024

The new version of IAVL, which will completely replace the old database, is in the preparation phase and promises to eliminate any legacy code linked to the case.