Cosmos Hub validators restarted block production on Sept. 23 at 12:00 UTC after a roughly 24-hour, 48-minute halt caused by a governance attack on Neutron. The first block after the restart included a forced transfer of 1,227,121.37 ATOM, worth approximately $2.2 million, from an attacker-linked address to a newly created recovery address. Cosmos Hub emphasized that its own network was not exploited, describing the intervention as an effort to secure assets bridged from Neutron before they could move further.
The incident originated on Neutron, where an attacker accumulated enough NTRN voting power to pass an expedited governance proposal and reassign administrative rights over 11 smart contracts linked to Astroport, Drop, and other protocols. Those contracts were migrated to malicious code, allowing assets to be withdrawn. Former Neutron contributor Spaydh estimated the initial impact at roughly $4.4 million, including about $3 million in ATOM, $1.2 million in USDC, roughly $100,000 in DYDX, and smaller amounts of wstETH and WETH. CryptoSlate previously reported losses of roughly $9.3 million. Neutron’s rate limits and halt prevented more than $1.6 million in USDC and significant amounts of NTRN and ASTRO from leaving the network.
When validators paused Cosmos Hub, about 70% of the stolen ATOM remained on the chain, putting roughly $2.15 million of ATOM within reach. The first-block sweep secured most of that balance and placed it in a community validator multisig. However, a later refund from THORChain reached the attacker-linked address seven blocks after the restart. That transfer of 168,990.9 ATOM remained untouched for almost six hours before being moved to Osmosis and sold in batches for about 266,841 USDC, with much of the proceeds converted into Ethereum. Analyst Rarma said an earlier attempt to transfer 500,000 ATOM failed because the wallet lacked sufficient funds, but the later IBC transfer succeeded after the recovery transaction had already executed.
Attention is now shifting back to Neutron. Contributors have reportedly prepared a new binary that would restore affected contracts to their previous code and administrators, tighten governance controls, and move remaining attacker-controlled assets into a validator multisig. Neutron was targeting a restart within roughly 24 hours, with asset returns expected to begin afterward. Cosmos Hub said a separate forum update will follow with further details on the secured ATOM and coordination with affected protocols.
