Cosmos Hub validators secure 1.23 million ATOM after Neutron governance attack

Validators on the Cosmos Hub intervened after a governance attack on the Neutron chain resulted in the theft of roughly 1.73 million ATOM. By pausing the Hub for about 24.5 hours and deploying a one‑time software update, they moved 1,227,121 ATOM to a multi‑signature recovery wallet.

Network halt and software patch

At around 09:50 UTC on September 22, Neutron contributors alerted Hub validators to the attack. Validators controlling more than one‑third of voting power stopped their nodes, halting the Hub at block 33,086,740 by 11:18 UTC. Cosmos Labs prepared a targeted software change (Gaia v28.3.0) that redirected the attacker’s balance to a wallet requiring four of six designated signers to approve any transaction.

Recovery wallet and secured funds

The recovery wallet holds 1,227,121.37 ATOM. Six community validators – Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu – control the signing keys. The wallet cannot move funds until a Cosmos Hub governance proposal authorizes the transfer.

Remaining stolen assets

Approximately 500,000 ATOM had already been swapped for ETH via THORChain before the halt and cannot be recovered through the Hub update. After the network resumed block production on September 23, the attacker moved an additional 168,990.9 ATOM to Osmosis and sold it.

Next steps

The Neutron recovery team plans to submit a Cosmos Hub governance proposal within the coming week, outlining the destination and process for returning the secured ATOM. The proposal will give ATOM holders a direct role in deciding how the funds are redistributed.

Broader coordination

Cosmos Labs has shared the attacker’s addresses with more than 30 exchanges, bridges and custodians, many of which have blocked the accounts. Recovery efforts are also underway on other chains that received stolen assets, including dYdX, Noble, Axelar and various EVM networks.