On September 22, an attacker exploited a governance proposal on the Neutron network, gaining control of contracts used by Astroport and other DeFi protocols. The breach allowed the thief to transfer roughly 1.73 million ATOM to the Cosmos Hub. In response, Cosmos Hub validators halted the chain, applied a one-time software patch, and transferred 1,227,121.37 ATOM to a recovery multisig address. Distribution of the recovered assets now hinges on a separate governance vote.

Emergency Halt and Patch

The Cosmos Hub stopped block production at height 33,086,740 after the breach was detected. Validators agreed to restart on Gaia version 28.3.0, which contained a targeted state change that moved the stolen ATOM from the attacker-linked address into a six-signer multisig wallet. More than 67% of voting power approved the binary before the chain resumed at 12:00 UTC on September 23, and the transfer executed shortly after at 12:06 UTC. The patch was limited to that specific address and did not affect other user balances or delegations.

Custody Versus Authority

The multisig is controlled by six validators—Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu—each holding a private key. Four signatures are required to move funds. However, the signers have publicly stated they will not act until a Cosmos Hub governance proposal authorizes a legitimate transfer. Cosmos Labs, the network’s development arm, does not possess any keys to the wallet and therefore cannot move the assets unilaterally.

Ongoing Governance Process

At the time of reporting, no proposal had been passed to grant the multisig the authority to distribute the recovered ATOM. Proposal 1056, titled “ATOM Refund & Justice Bounty,” was still under vote but did not cover the Neutron-response multisig. The most recent passed proposal (1057) dealt with an unrelated IBC client. A future proposal is expected to incorporate evidence from affected Neutron participants, including Astroport and Drop, and outline how the recovered tokens should be allocated.

Funds That Escaped the Patch

The one-time patch could not capture deposits arriving after the restart. Approximately 168,990.9 ATOM was refunded via THORChain to the attacker’s address just after the chain resumed, bypassing the multisig. Those tokens were subsequently moved to Osmosis and sold, illustrating the limitation of a single-execution fix.

Next Steps for Recovery

Neutron’s developers have relaunched the network with mitigations and are compiling evidence of losses. Once a comprehensive recovery proposal is submitted and approved on the Cosmos Hub, the six validators can sign off on the transfer of the secured ATOM to the rightful claimants. Until that governance hurdle is cleared, the recovered assets remain in custody without a designated recipient.

Why it matters

The incident highlights the interplay between technical emergency responses and on-chain governance in decentralized ecosystems. While validators can swiftly intervene to prevent further loss, the ultimate allocation of recovered funds still depends on community-driven decision-making, underscoring the importance of transparent and efficient governance mechanisms in blockchain networks.