Cosmos-Based Juno Blockchain Pushed Offline in Apparent Attack

A malicious smart contract has put the network out of commission for over 24 hours and comes less than a month after a controversial governance vote.

AccessTimeIconApr 6, 2022 at 11:59 p.m. UTC
Updated May 11, 2023 at 5:00 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Cosmos-based blockchain Juno went offline on Tuesday as the result of a suspected attack on the network.

The network remains offline as of press time, but no user funds have been impacted and the Juno core development team says a fix is in the works, according to a retweet from the project’s official Twitter handle.

A Juno core developer speaking to CoinDesk on the condition of anonymity said the network crash stemmed from a malicious smart contract masked to look like a simple “hello world” program.

The suspected attacker sent a string of over 400 transactions to the smart contract over the course of three days in a process of apparent trial and error – eventually landing on a specific combination of transactions that crashed the network.

According to the developer who spoke with CoinDesk, the attacker exploited a blockchain vulnerability that Juno planned to address via an update scheduled for a few hours after the attack. The developer says the vulnerability had been publicly disclosed, as it impacted all blockchains that use the CosmWasm smart contract platform.

This is the second major challenge Juno has faced in the past month. In March a controversial governance vote removed tokens from a “whale” accused of manipulating a JUNO airdrop – an unprecedented case of a decentralized community directly voting to cut a wallet’s token balance.

The JUNO token, which has a $1 billion market cap according to CoinGecko, has dropped 7% in the past 24 hours.

As of now, the identity of the attacker is unknown.

According to Daniel Hwang, head of protocols at Stakefish, which runs a validator for Juno, members of the Juno community are trying to figure out who would have been motivated to execute the attack for no obvious financial gain. According to Hwang, token holders are pointing fingers at potential culprits ranging from competitor blockchains to bagholders on the losing end of last month’s governance vote.

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Sam Kessler

Sam is CoinDesk's deputy managing editor for tech and protocols. He reports on decentralized technology, infrastructure and governance. He owns ETH and BTC.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.


Read more about