Cosmos Hub Secures 1.23M ATOM; Refunds Await Vote

On Sept. 22 an attacker gained administrative control of contracts on the Neutron network and moved about 1.73 million ATOM off that chain. Approximately 1,227,121.374688 of those tokens reached an account on the Cosmos Hub. Hub validators halted the chain at block height 33,086,740 and applied an emergency software patch that transferred the Hub-linked balance into a recovery multisig.

Validators coordinated a restart on a patched Gaia client, v28.3.0. Blocks resumed on Sept. 23 at 12:00 UTC and the one-time state change executing the transfer took effect at about 12:06 UTC. The binary was tested against a forked mainnet state and distributed with a checksum; the maintainers withheld the source diff initially because it would have revealed security fixes that remained under an embargo.

The recovered ATOM is held in a multisig controlled by six validator operators: Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. The wallet requires four of six signatures to move funds. The signers have conditioned any distribution on a passed Cosmos Hub signaling proposal that authorizes transfers from the recovery multisig. Cosmos Labs does not hold keys to the wallet.

Neutron contributors and affected protocols, including Astroport and Drop, were preparing evidence and a distribution plan to identify claimants and allocations. Neutron had relaunched with mitigations by Sept. 25. The Hub’s public governance listing checked at 15:40 UTC on Sept. 26 showed no passed proposal authorizing the recovery multisig’s distribution. Proposal 1056, titled “ATOM Refund & Justice Bounty,” remained in voting and did not grant the multisig permission to transfer funds; proposal 1057 addressed a separate Realio IBC light-client recovery.

The emergency patch captured only the balance present in the attacker-linked Hub address at the time of the halt. About 500,000 ATOM had already been swapped through THORChain and moved off-network before validators halted the Hub. A THORChain refund of 168,990.9 ATOM completed after the restart and therefore was not included in the one-time state sweep; those tokens were transferred to Osmosis and sold. Validators noted that modifying the tested binary to capture later deposits would have required different code and a longer network halt.

Until Neutron finalizes its evidence and distribution plan and a Hub governance proposal passes, the ATOM in the recovery multisig remains in custody with no public decision on recipients. The patch prevented further outflows from the specific Hub account but did not reverse the broader Neutron breach.