CryptoSlate
Cosmos Hub resumed block production on Sept. 23 after a nearly day-long halt, using its first block to move 1,227,121.37 ATOM, worth about $2.2 million, from an attacker-linked address into a recovery address. The funds were tied to a governance exploit on Neutron, and Cosmos Hub said its own network was not exploited. The secured ATOM is now held in a community validator multisig.
Why it matters
The intervention captured most of the ATOM that remained on Cosmos Hub, but it did not close the door on later transfers to the attacker-linked address. Analyst Rarma said 168,990.9 ATOM arrived seven blocks after the restart, remained there for nearly six hours, then moved to Osmosis and was sold in batches for about 266,841 USDC. Much of the proceeds was subsequently converted into Ethereum.
The underlying attack began after an attacker accumulated enough NTRN voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts. The contracts, including infrastructure used by Astroport and Drop, were migrated to malicious code that enabled withdrawals. Neutron’s rate limits and later halt protected some assets, including more than $1.6 million in USDC, according to former contributor Spaydh.
Market impact
The episode shows the limits of a chain halt as a recovery tool: the first-block sweep secured a large balance, while ATOM arriving afterward escaped the operation. Cosmos Hub has not publicly explained why the later transfer was allowed or whether further restrictions were planned.
Neutron contributors have prepared a new binary to restore affected contracts and administrators, tighten governance controls, and move remaining attacker-controlled assets into a validator multisig. A Neutron restart was targeted within roughly 24 hours, with asset returns expected afterward. The recovery process and the final accounting for affected users remain in focus.
Frequently asked questions
-
How much ATOM did Cosmos Hub move into recovery?
The first block after the restart moved 1,227,121.37 ATOM, worth about $2.2 million, from an attacker-linked address into a recovery address.
-
How did 168,990.9 ATOM escape the recovery sweep?
The ATOM arrived at the attacker-linked address seven blocks after the restart, after the initial sweep had executed. It later moved to Osmosis and was sold.
-
What caused the Neutron exploit?
An attacker accumulated enough NTRN voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts. Those contracts were migrated to malicious code that enabled withdrawals.
-
What happened to the ATOM that escaped?
Analyst Rarma said it was transferred to Osmosis and sold in batches for about 266,841 USDC. Much of the proceeds was subsequently converted into Ethereum.
-
What are Neutron contributors preparing before the restart?
They have prepared a new binary to restore affected contracts and administrators, tighten governance controls, and move remaining attacker-controlled assets into a validator multisig.
TheBlock