Cosmos Hub Takes Action: 1.227 Million ATOM Secured After Neutron Exploit

A recent governance attack targeting the Neutron blockchain led to the theft of liquidity from connected protocols like Astroport. The attacker subsequently moved approximately 1.73 million ATOM to the Cosmos Hub network.

It is crucial to note that Cosmos Hub itself was not compromised in this incident. The attack vector was specific to Neutron, and user funds on the Hub remained entirely safe. The Hub served primarily as a transfer layer for the stolen assets.

The Critical 24-Hour Halt and Asset Recovery

To prevent the stolen ATOM from being moved off-chain, Cosmos Hub validators coordinated a network halt on September 22nd. This pause lasted approximately 24.5 hours, creating a window for recovery efforts.

During this period, 1.227 million ATOM remained in the attacker's Hub address. When the network resumed block production on September 23rd using the patched Gaia v28.3.0 software, a one-time change was executed to transfer these funds to a secure 4/6 multi-signature address.

  • Assets Secured: 1.227 million ATOM successfully moved to the custody address.
  • Custodians: The address is managed by a group of reputable firms including Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu.

Asset Trail and Next Steps

Not all stolen funds were recovered. Prior to the network halt, the attacker had swapped roughly 500,000 ATOM for ETH via THORChain. These assets are considered irrecoverable.

Additionally, after the network resumed, a refund mechanism on THORChain sent about 169,000 ATOM back to the attacker's address, which were then quickly moved and sold on Osmosis.

The 1.227 million ATOM now held in the multi-signature address are in safe custody. These funds will not be staked, lent, or traded. Their return to rightful owners is contingent upon the approval of a formal governance proposal by the Cosmos Hub community.

The Neutron team is expected to submit a detailed recovery plan and the corresponding governance proposal for community vote as early as next week.