Cosmos Hub recovers $2.2M in ATOM; 169,000 tokens escape

Cosmos Hub resumed block production after a nearly 25-hour halt and moved 1,227,121.37 ATOM into a recovery address following a governance exploit on Neutron. Validators paused the chain on Sept. 22 to stop bridged assets from leaving the network and restarted on Sept. 23 at block 33,086,741.

The halt followed a Neutron governance attack in which an attacker gained enough voting power to pass an expedited proposal that reassigned administrative rights over 11 smart contracts and withdrew funds. The attacker migrated those contracts to malicious code and moved assets across chains into Cosmos Hub before validators stopped production.

Former Neutron contributor Spaydh described the initial impact at about $4.4 million, including roughly $3 million in ATOM, $1.2 million in USDC, about $100,000 in DYDX and smaller amounts of wrapped Ether and liquid staking tokens. Neutron rate limits and the chain halt prevented additional assets from leaving; more than $1.6 million in USDC plus significant NTRN and ASTRO balances remained protected.

The first block after the restart transferred 1,227,121.37 ATOM from an attacker-linked address into a community validator multisig for reconciliation and return. Cosmos Hub confirmed the network itself was not exploited and that the intervention aimed to secure bridged assets tied to the Neutron incident.

A gap in the recovery emerged when a THORChain refund of 168,990.9 ATOM arrived at the attacker-linked address seven blocks after the restart. Crypto analyst Rarma tracked the tokens sitting in the wallet for almost six hours before they were moved to the Osmosis decentralized exchange and sold in batches for about 266,841 USDC, with much of the proceeds later converted into Ethereum.

An earlier attempt to transfer 500,000 ATOM had been included in a block and paid a fee before failing due to insufficient funds in the wallet; that failed transaction showed the attacker-linked address could still submit an IBC transfer after the restart. Cosmos Hub has not publicly explained why the later refund transaction proceeded after the sweep or whether additional restrictions were meant to block transfers reaching the address after the recovery operation.

Most of the recovered ATOM remains in community control. Validators, Neutron contributors and affected protocols are coordinating to reconcile the captured balance against the tokens that escaped after the restart and to return assets to their original owners once processes are finalised.

Neutron contributors have prepared a new binary to restore affected contracts to their previous code and administrators, tighten governance controls and move remaining attacker-controlled assets into a validator multisig. The project is targeting a restart within about 24 hours and expects asset returns to begin after the chain resumes. Cosmos Hub indicated a forum update will follow with further details on the secured ATOM.