Ray Raspberry

@theturkeydao Advisor &
Don Quixote of the Cosmos

[Ray Raspberry @RayRaspberry1]

@svabhishek @sunnya97 Brave self-promotion gets in the way of using it by attempting to funnel users through their subpar built-in products. Better to just use chromium + extensions for a webkit browser imho.

I often use a clean chromium build for AI Agents.

[Ray Raspberry @RayRaspberry1]

@sunnya97 @nicolaslara Seems like it would be much easier to reveng/write extensions than reverse engineer and rewrite an entire browser. Zen is decent enough but needs some deep cleaning of memory related issues (similar to Arc).

[Ray Raspberry @RayRaspberry1]

@nicolaslara @sunnya97 zen is good, but bloated as well. Arc was great but also started to suffer bloat and memory issues.
It seemed like Zen and Arc were both aiming for similar feature and usability standards.

[Ray Raspberry @RayRaspberry1]

https://t.co/jHWFqxUuEK

[Berachain Foundation 🐻⛓ @berachain]

The recent Cosmos EVM vulnerabilities do not affect Berachain, which uses BeaconKit. BeaconKit only makes use of CometBFT for consensus, while using Bera-reth for execution.

If you have any questions to this effect, please do not hesitate to reach out.

[Ray Raspberry @RayRaspberry1]

No need to guess, it's Cosmos.
Welcome to the new Internet.

[Initia 🪢 @initia]

As of Oct 23, 2026, 3:41:30 PM UTC, the Initia L1 and Rollups have been halted due to a security incident.

Our team is actively investigating the situation and working to establish the full scope of any impact with security teams, validators, and exchanges.

We will share verified information through our official channels as it becomes available.

Please remain cautious of unofficial links, messages, or claims circulating during this time.

[Ray Raspberry @RayRaspberry1]

@ZackJampolin @cosmos Marks, Stooges, Mugs, Rubes, Gulls...

[Ray Raspberry @RayRaspberry1]

What really sums up @cosmos well in this photo is the seats at the table for the insiders. No seats for the clients and community.

[Cosmos - The Interchain ⚛️ @cosmos]

Cosmos enables banks to issue tokenized deposits that directly connect to their Jack Henry @JH_Fintech core. Achieve 24/7 cross-border settlement in under 3 seconds.

Cosmos Tokenization Suite is available as a Jack Henry platform integration: https://t.co/OD8zGXGMUf

Meet us at Jack Henry Connect, Booth 1508.

[Rarma @Rarma_]

Stratos (stratos-1), a Cosmos EVM chain, was exploited and its validators halted the chain. Here is what happened and where the funds went, read directly from the chain.

The chain is frozen at block 16,008,475, last block 05:21 UTC.

The bug is a custom EVM precompile at 0x0000000000000000000077656233636f736d6f73 — the tail bytes spell "web3cosmos". It takes a Cosmos message in its calldata and runs it as whatever "from" account is named inside, without checking the caller owns that account or was authorised by it.

The attacker wrapped calls to it in a Cosmos authz MsgExec, each carrying a forged bank MsgSend from a victim to the attacker. In a single transaction, block 15,986,214, this drained 50,616,206 STOS from 11 accounts into the collector 0x57e1… / st12lsj78….

Proof it is an authorisation bypass and not stolen keys: the largest victim lost 23M STOS and now holds 1 wei. That account has a null public key. It has never signed a transaction, so it could not have authorised anyone. The precompile moved its funds anyway.

Where the funds went:
- ~40M STOS was IBC-transferred to Osmosis (osmo14qpeg…) at block 15,991,081, about a day before the halt. Around 10M of that was later sent back to Stratos. So on the order of 30M net left the chain before validators stopped it.
- ~10M of the loot sits frozen in the Stratos WSTOS bridge vault (0x2a7157…), which also holds ~22M of pre-existing TVL, all frozen by the halt.

The halt did not catch the bulk. A validator halt only protects what is still on the chain, and most of the stolen STOS had already gone to Osmosis over plain IBC, where it was swapped and moved onward.

Attacker cluster:
- collector: 0x57e12f1d41b7daeb9716da758f05bec2636daea2 / st12lsj78…
- authz operator: st13v7qxgvv9ncs6t25jc5kqku4wxq8d6wyvtv66t
- Osmosis landing: osmo14qpeg04hyx6s6dax44q9sx268ckgr6zzhhswja

Root cause for the team: an EVM precompile that executes Cosmos messages has to verify the caller is authorised for the "from" account named in the message. This one does not. Same class as the KiiChain/MANTRA Cosmos EVM precompile incidents, distinct root cause.

Every figure is read from Stratos and Osmosis RPC. The onward path of the Osmosis portion is still being traced.

@Stratos_Network

[Ray Raspberry @RayRaspberry1]

@camiinthisthang It's not known unknowns that are the issue, it's the unknown unknowns.

Lack of knowledge something is wrong until it's exploited or physical property is destroyed. AI doesn't care, it's not liable.

What ethical business owner would offload that kind of risk to their clients?

[Ray Raspberry @RayRaspberry1]

@codehans1 @laurashin yes. https://t.co/aWTZXJPKUB

[Ray Raspberry @RayRaspberry1]

@laurashin @cburniske @Unchained_pod Probably worth a mention on your podcasts @laurashin
when "guests" like @placeholdervc are investors in other "guests": @CelestiaOrg and Solana (labs?)

https://t.co/celkwUe6h6

https://t.co/QmjpGcVWxv

[Ray Raspberry @RayRaspberry1]

@jacobin7x @stetun3 nothing

[Ray Raspberry @RayRaspberry1]

@larry0x any other distro? not really.

openSUSE using Tumbleweed/Leap with btrfs
Fedora with btrfs
Ubuntu with Btrfs
CachyOS/Garuda with snapper + btrfs

...all have snapshot and rollback. used it many times, works fine.

[Ray Raspberry @RayRaspberry1]

@joe4deadcat https://t.co/lhUP3SCBxB

[Hugh Jass @HughJassrto]

@NBCNews @nbcselected NBC news next week.

[Ray Raspberry @RayRaspberry1]

@AirdropGlideApp @0x33cd the more important question is:
If the staff who are paid (staking rewards) to secure your bank hand over other customers' account access to someone just because they deposited $20K, who's at fault? Bigger question: do you keep employing that staff? Validators be socializing Ls

[Ray Raspberry @RayRaspberry1]

@KneelLabs66000 @neutron_org Si el personal, al que se le paga (con recompensas de staking) por proteger tu banco, entrega las llaves de las cuentas de otros clientes a alguien solo porque depositó $20K, ¿quién tiene la culpa? La pregunta más importante: ¿sigues empleando a ese personal?

[Ray Raspberry @RayRaspberry1]

It wasn't an exploit.
@neutron_org Validators passed the prop.
Two likely situations are: Validators understood the proposal (handing over admin control of contracts) and were indifferent or didn't read the substance of the proposal to begin with.

Either way is negligence.

[Cosmos Hub ⚛️ @cosmoshub]

The Cosmos Hub validators have temporarily halted the network to mitigate ATOM losses from a governance exploit on @neutron_org. The Hub itself is not affected.

The community is identifying and isolating wallets with impacted funds and will decide what to do with them before resuming operations.

Please stay tuned for further updates.

[Ray Raspberry @RayRaspberry1]

@AirdropGlideApp @0x33cd

[Rarma @Rarma_]

Neutron / Astroport exploit: what happened when the Cosmos Hub restarted.

The 1.2M cosmos:native sweep worked. The 168,990 ATOM THORChain refund didn't get caught. It landed on the attacker a minute after the restart, and he sold all of it for about 100 ETH.

Correction first

In my last post I said the refund couldn't move once it landed, because the Hub had blocked the attacker's address. That turned out to be wrong, it appears the developers of the hub failed to correctly block the attackers address, when they had a ~6 hour window to act.

What worked

The Hub restarted at 10:06 pm AEST on v28.3.0. In the first block (33,086,741), the upgrade moved 1,227,121.37 ATOM off the attacker's address to cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64. It's still there, untouched. That's about $2.2M kept from him.

What didn't

10:07:38 pm, block 33,086,748. THORChain's vault sent the refund, 168,990.898794 ATOM, to the attacker's address.

10:09:29 pm, block 33,086,761. He signed a 500,000 ATOM IBC transfer to Osmosis. It was included in a block, he paid the fee, and his account sequence went from 8 to 9. It failed only because he asked for more than he had.

That transaction should never have reached a block if the address block was working.

3:54:58 am, block 33,090,325. He tried again with the right amount. It went through.

Where it went

He sold it on Osmosis in chunks of about 20,000 ATOM between 3:58 and 4:48 am, for 266,841 USDC, an average of $1.58.

188,832 USDC went through Noble and Circle's CCTP to 0xe149310eB8b1b3D9C471CcD81819D393621fBA5c and was swapped to $ETH within minutes. +70.84 ETH.
50,000 ATOM went to a new key first. 30,000 of it made a round trip Osmosis → Hub → Terra → Hub → Osmosis. He then sold it and sent 78,010 USDC through Axelar to a new wallet, 0x9bfcca13b4ac907433ac68766e96309ac867f819. 29.22 ETH, never sent.

53 minutes from the Hub to ETH.

Root cause: two gaps

The refund arrived after the sweep. The upgrade moved what was on the address at block 33,086,741. The refund came seven blocks later.

THORChain had GAIA halted (HALTGAIACHAIN = 1), but signing for GAIA was never halted (HALTSIGNINGGAIA = 0). My reading is that the halt stops THORChain watching the Hub, not signing for it. The vault's refund went out as soon as the Hub produced blocks. THORNode still shows the refund as "not signed" because it can't see the Hub.

The ante-handler block didn't reject him. A transaction the ante-handler rejects never reaches execution. His reached the bank module and paid a fee. I can't see the v28.3.0 code (only v28.0.0 is public), so I can't say why. The chain shows it wasn't enforced for his address on an IBC transfer.

Both gaps were visible on-chain by 10:09 pm. The refund sat on his address for 5 hours 47 minutes before he moved it.

Where the attacker's funds are now

0xEF6c5A31df984c8569236a0AbC1f27580E2a5D54: 671.0 ETH
0xe149310eB8b1b3D9C471CcD81819D393621fBA5c: 94.43 ETH 0x9bfcca13b4ac907433ac68766e96309ac867f819: 29.22 ETH

New Cosmos-side addresses from last night: osmo1erq7tre6nk0jfx203z8ey75g4m7yfrckl3qx87 cosmos1erq7tre6nk0jfx203z8ey75g4m7yfrckh2nk3v terra1utez3t0nvg34d9xfswn8058kypney2c3pkx883
Worth taking from this

A sweep in an upgrade handler only covers what's on the address at that block. Anything still in flight needs its own plan.
Test an address block with a real transaction as well as a simulated one, and watch the account sequence right after restart.
Halting a chain in THORChain doesn't stop outbound signing for that chain.
@cosmoshub @THORChain @Osmosis_Zone @Neutron_org @astroport_fi

[Rarma @Rarma_]

Neutron / Astroport exploit, update.

The attacker's 1,227,121 ATOM on the Cosmos Hub is being moved to a new multisig when the chain restarts. One more piece still needs dealing with after restart: a 168,990 ATOM refund on its way back to him.

What's already on his address

When the Hub halted at block 33,086,740, the attacker's address held 1,227,121.37 cosmos:native (~$2.22M). The new Hub binary does two things. The upgrade handler moves that balance to a new multisig, and the ante-handler blocks his address from signing anything.

The refund nobody could see

His last THORChain swap was 200,000 ATOM streamed into $ETH. Only 15.5% had filled when the Hub stopped. THORChain paid that part out as 19.92 ETH and closed the swap. The other 168,990.898794 ATOM is queued as a refund to his Hub address.

His wallet shows nothing pending, and the swap looks finished once the ETH arrives. I found the refund by reading THORChain's outbound queue (https://t.co/1c2QSRxaW8) directly and matching it on the swap's inbound hash:

REFUND:02DABD55C0A3EBEA3271763484542CB59A22E968402F91690471B7D2589B04A7 168,990.898794 ATOM → cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n

It's scheduled but not signed, and was still in the queue at 23:43 UTC on 22 Sep. It hasn't gone out because THORChain has GAIA halted (HALTGAIACHAIN = 1). When that lifts, the vault signs and the ATOM lands on the attacker's address.

That will be after the Hub upgrade has already run, so the refund misses the multisig move.

Can he get around the block?

Before the restart I checked whether he has any other way to move funds from that address. He doesn't. It's a plain account with one key. No authz grants in either direction, no fee grants, no delegations, unbonding or rewards, not a validator, no contracts, gov deposits or IBC transfers. If that key can't sign, nothing moves.

That's why the ante-handler block works here.

What still needs doing after restart

The 168,990 ATOM (~$306k) needs one of two things: a second sweep once it lands, or THORChain node operators holding or redirecting that outbound before they unhalt GAIA. The block stops him moving it. It still needs to be moved to the multisig.

Totals at $1.81 ATOM

1,227,121.37 ATOM on the address → multisig at upgrade 168,990.90 ATOM refund → needs a sweep after restart

1,396,112.27 ATOM, about $2.53M, kept from the attacker.

[Ray Raspberry @RayRaspberry1]

@ToschDev @neutron_org the last one.
50D41B97A698B62E02A1FE1E1260C758D75E1E82FCB9735BBD5BBC6381400B9E