Applies to: operators running a Hermes IBC relayer whose Lumera signing account is a legacy (coin-type 118 secp256k1) account, against an EVM-enabled Lumera chain (post-EVM upgrade)
Prerequisite reading: EVM Migration User Guide for the chain-level mechanics of legacy → EVM account migration
A Hermes relayer signs IBC packet/ack/timeout transactions on Lumera using a key in its own keyring (~/.hermes/keys/<chain-id>/keyring-test/<key_name>.json). If that account was created before the EVM upgrade it is a legacy secp256k1 (coin-type 118) account, and it appears in lumerad query evmigration legacy-accounts until migrated.
Migrating the relayer account is different from migrating a normal user account in one important way: two independent tools must agree on the key. lumerad performs the migration (it needs the destination key in its keyring to sign MsgClaimLegacyAccount), and Hermes must independently re-derive the same account from the same mnemonic so it can keep signing. Those two derivations only line up if you pin the HD path — see the gotcha below.
<aside> ⚠️
This is a service-affecting, irreversible change. The legacy relayer address is blocked after migration. Plan a short relaying pause, and do not migrate until the derivation gate (Step 3) passes.
</aside>
Lumera's EVM keys use eth_secp256k1 at HD path m/44'/60'/0'/0/0. lumerad keys add --coin-type 60 --algo eth_secp256k1 uses exactly that path.
Hermes' default ethermint derivation does NOT use m/44'/60'/0'/0/0. Given the same mnemonic, Hermes' default and lumerad produce different Lumera addresses:
| derivation | address (example) |
|---|---|
lumerad --coin-type 60 --algo eth_secp256k1 (path m/44'/60'/0'/0/0) |
lumera1ccvqdk… |
hermes keys add (ethermint default path) |
lumera1addyff… ❌ different |
hermes keys add --hd-path "m/44'/60'/0'/0/0" |
lumera1ccvqdk… ✅ matches lumerad |
Always pass --hd-path "m/44'/60'/0'/0/0" to hermes keys add for a Lumera EVM relayer key. Without it Hermes derives a key for a different address and will not control the migrated account.
You must also tell Hermes the chain uses Ethereum-style keys, via address_type in config.toml (Step 1).
ethermint address-type support.lumerad keyring (to sign the migration).lumerad binary that supports eth_secp256k1 (the EVM-era Lumera binary).lumerad query evmigration params → enable_migration: true).