Namada hackers unload fresh blow on Cosmos ecosystem

Privacy blockchain Namada has lost roughly $600,000 in an exploit, wiping nearly all value from its multi-asset shielded pool and adding to a string of security failures across the Cosmos ecosystem this year.

Namada confirmed the breach on June 20, in a post made on X, stating that its team was “investigating the issue” and involving the relevant parties.

The project also made an appeal to the hacker to return the funds, writing, “If you are the white hat hacker behind this exploit, please get in touch with us.” 

What happened to Namada following the breach?

The shielded pool that suffered the attack is known as the multi-asset shielded pool (MASP), and it is Namada’s core privacy feature, designed to let users hold and transfer multiple token types with encrypted balances.

Following the exploit, Namada’s total value locked (TVL) crashed from around $600,000 to just $598 in the span of a day. 

Also, Namada’s block explorer appears stalled with the most recent indexed block dating to June 7. This has raised questions about the chain’s data infrastructure and whether it was functioning normally before the attack.

Is there a growing wave of attacks targeting the Cosmos ecosystem?

The Namada exploit came hours after a separate incident hit Secret Network, where an attacker drained $4.67 million in Axelar-bridged tokens by exploiting a missing validation check in a cross-chain smart contract. 

That vulnerability that was exploited had been existing, unpatched, in the deployed code since March 2023, according to blockchain security firm Common Prefix.

Ed, the founder of AirdropGlideApp, posted on X that the back-to-back incidents made it “worrying leaving assets” in the Cosmos ecosystem, pointing to the Axelar/Secret exploit and the Namada drain alongside an earlier attack on Saga. 

Security researcher fr1ko.eth noted that in the 24 hours ending June 20, both Namada and mySwap (a Starknet-based DEX) had been compromised, with the two hacks totaling roughly $900,000.

The security failures compound what has already been a difficult year for the Cosmos ecosystem. 

The network experienced an exodus of projects late last year, and that continued into the new year, per a Cryptopolitan report.

Noble, a stablecoin infrastructure project that had processed billions in volume, left Cosmos for an EVM-based layer-1. 

Penumbra, a privacy-focused chain, shut down entirely. Comdex, Kujira, and Evmos halted development, while projects including Omniflix, Elys, and Jackal migrated elsewhere. 

Cosmos’s native token, ATOM, currently trades around $1.78 and is in the depths of a decline of over 96% from the all-time high it achieved in 2021.

Cosmos is not oblivious to the happenings and has taken steps to stabilize. In June, Cosmos Labs acquired the Mintscan blockchain explorer and opened a Seoul subsidiary to consolidate operations around the Cosmos Hub, Skip:Go, IBC Eureka, and Mintscan under one roof, according to Cryptopolitan’s reporting. 

Leadership has also signaled plans to redesign ATOM’s tokenomics and pursue institutional use cases.

But repeated exploits across Cosmos-linked chains undermine the effort. Bridge and smart contract vulnerabilities have been a persistent weak point plaguing the ecosystem. 

Does this exploit call into question Namada’s credibility?

Namada launched with an unusual token structure that was unpopular before any exploit occurred. 

On-chain investigator ZachXBT flagged in August 2024 that the NAM token shipped with 100% of supply unlocked at its token generation event, with no lockups for the 18.5% team allocation or the 32% investor share. 

At the time, ZachXBT questioned how participants would stay motivated to build “when it’s a race to dump all tokens from day 1.”

With the latest exploit, users now face limited visibility into what happened and what, if anything, remains recoverable.

The Namada team has released neither a post-mortem nor an update on when it will restore services as of the time of publishing