Formally ask ICF if Zaki Manian disclosed the north Korean origins of lsm

  1. @jtremback has said that informal systems wasn’t informed of the origins of the lsm, but he isn’t CEO. Informals CEO should respond, and a tweet should come from the informal Twitter - informal seems to think that they can make official statements from the hub Twitter.

  2. I wasn’t informed of the origins of the lsm (I worked on it)

  3. stride hasn’t responded

  4. interchain foundation hasn’t responded

  5. Zaki hasn’t said weather or not he informed icf, informal or stride

Grace asked:

I asked

But there’s been no response at all

Likely this governance proposal should not be necessary, but the ICF remains silent in the face of incredibly serious questions.

This incident has compromised the safety of the hub and its contributors.


Yes: formally ask the interchain foundation if they were told that the lsm was built by the world’s most prolific group of crypto theft experts – the north Korean military by Zaki Manian, who learned that his company iqlusion had hired members of the north Korean military from the fbi in march 2023

3 Likes

More info…

1 Like

Tough times!

Agree, we need formal address from ICF and/or Interchain

2 Likes

Interchain = ICF

We also need a proper statement from informal

Ideally from iqlusion as well

And stride

I’ve given mine… At the time I was running hub security. Zaki didn’t tell me the code history.

:frowning:

1 Like

Thank you for your continued work on helping ensure the security of the Cosmos Hub, @jacobgadikian.

The continued lack of response RE this urgent issue, from hub leaders, is astounding.

2 Likes


We got some small responses today, but there remains no response from the foundation, which actually paid for the work.

My pull request for a warning on the relevant Cosmos SDK branches has been closed by an icf funded team.

Not disclosing the code origins is of course how we ended up here.

1 Like

I think it is pretty damn obvious, you guys just have to listen to the Zaki episode for the ZK podcast with Anna Rose. In my opinion he never disclosed anything. Why am I pretty sure?

The podcast was recorded a couple of weeks ago, he 100% knew that NKs were involved in the LSM, he never mentions it, he never talks about it. The FBI already investigated the case for over a year, so it was clear that this will become public at a certain point and will have huge remifications and it won’t be possible for him to work on any project related to the HUB. What does he do instead? He frames it like it was an ideological choice and he doesn’t believe in the vision any longer. To this day we don’t even have a public statement from Zaki on this issue. He obviously tried and still tries to move it under the rug. Even if he is under investigation himself, there are several ways how you can disclose the issue without giving too much information.

If he didn’t disclose anything, Zaki is a persona non grata for the ecosystem. Just the way he handled this, you can’t be sure that this is the only instance, there might be other issues which he didn’t disclose or tried to move under the rug. He should be blacklisted from the HUB, other teams should think very hard if they want to continue to work with Zaki and hurt their brand.

And finally let me say this, mistakes can happen, everyone can fuck up, but if this happens you have to be open and honest about it. And it is pretty obvious in my opinion that neither was the case.

2 Likes

I don’t want to make any assumptions, but it is looking like what you say is true.

Still want ICF to confirm tho.

As for the notion of blacklisting - everyone will ultimately need to make their own choices. I know I won’t be doing any further work with him or his company.

1 Like

The LSM module should be deleted period. I don’t even care who was involved in building it. No one should be able to shovel staked ATOMs into a liquid staking protocol. If people want to use liquid staking they should be doing that with unstaked ATOM. End of fn story.

4 Likes

Unfortunately I don’t think that this is the right take. The North Korean military is the world’s best group of cryptocurrency thieves and they have stolen more crypto than anybody.

Your other reasons could be correct, however the theft angle is key imo.

2 Likes

Fully agree with @vixcontango that no one should be utilizing staked ATOM to provide liquidity to Liquid Staking Protocols. This further neglects Hub security. If anything, using their unstaked ATOM, but either way.

Any entity supporting this should be questioned, whether attempting to help secure the Cosmos Hub, or a governance takeover plot.

2 Likes

LSM is great in general, it allows capital to be more efficient and increases velocity

Liquid staked assets can encourage DeFi activities which can result to higher buying pressure among protocols. So removing it completely is kinda jumping off of innovation train. Rather, we should re-vamp how it is done and change the source code

Personally, I have same point of view about staked assets, there are there for the long run and I am not really looking to even liquid stake them, as I do not want to put additional risk.

I am not saying don’t liquid stake. LSM module allows staked assets to be transferred from your account to a liquid staking provider. I don’t think this feature should exist. If you want to liquid stake, do it with your unstaked assets - in other words you make a conscious decision to use defi and to liquid stake your assets from the get go. The LSM module currently introduces a security vulnerability.

Previously staked assets were more secure than unstaked assets because there is a time period introduced before they are available to be transfered. This time period allows for the owner of the assets to discover if his wallet has been compromised. For example, I know very easily if my funds are compromised or not if I don’t get staking rewards. Generally speaking even with cold storage there exist remote possibility that your computer has been hacked into and somebody is recording the letters you type. In other words, it is possible to steal your mnemonic and then recreate your wallet on another computer despite your best efforts. With staking and the unbonding period, a potential attacker has to wait before the funds are available to transfer and then you have the ability to restake your assets and foil their plan. That is why I have always been a fan of around 2-week staking periods. I think 4 weeks is too long but I think less than 2 weeks is too little and about 2 weeks is the perfect middle between security and liquidity.

My favorite security feature in all of crypto BY FAR is time-based security.

So LSM module completely obliterates that time-based security feature and I don’t like it one bit. Again this is not about banning liquid staking but banning the ability to transfer staked assets to a liquid staking provider. Banning this ability does not affect in any way money velocity or capital efficiency.

People either are staking or doing defi. Most people don’t have the time or intellectual capacity to make money out of defi strategies, defi is really a feature for hedge funds and professional investors. That is a decision they have made about their funds from the very beginning. Usually retail investors stake while professional investors use DeFi and therefore liquid stake. As we have seen there aren’t all that many hedge funds on the Cosmos Hub. In fact, one hedge fund after another have left ATOM over the past 2 years. Liquid staking didn’t get the market adoption that was foreseen at all. Maybe one day it will be arrive, but I can assure one thing - no hedge fund will stake their money if there is any form of risk for their money being compromised.

Not every hedge fund wants to do DEFI. Most just want to stake. LSM module absolutely destroyed the hedge fund market for ATOM.