Cosmos Hub Restarts and Recovers $2.2 Million in Stolen ATOM, Yet 169,000 Tokens Escape

Cosmos Hub resumed block production on September 23 after a nearly day‑long halt that was initiated to protect assets moved from the Neutron blockchain following a governance exploit.

Recovery of ATOM from the Attacker‑Linked Address

The first block after the restart transferred 1,227,121.37 ATOM—approximately $2.2 million—to a recovery address controlled by a community validator multisig. This sweep captured the majority of ATOM that had been bridged from Neutron before the halt.

Background of the Neutron Exploit

According to former Neutron contributor Spaydh, the attack began when an entity accumulated enough NTRN voting power to pass an expedited governance proposal. The proposal reassigned administrative rights over eleven smart contracts, including those used by Astroport and Drop, and replaced their code with malicious versions that allowed unauthorized withdrawals.

Initial estimates placed the total loss at roughly $4.4 million, comprising about $3 million in ATOM, $1.2 million in USDC, $100,000 in DYDX, and smaller amounts of wstETH and WETH. CryptoSlate previously reported a higher figure of $9.3 million, but Neutron’s rate limits and the subsequent network halt prevented a portion of those assets from leaving the chain.

Tokens That Evaded the Sweep

Crypto analyst Rarma identified a later IBC transfer that moved 168,990.9 ATOM to the attacker‑linked address seven blocks after the restart. The tokens remained there for almost six hours before being sent to Osmosis and sold for roughly 266,841 USDC, with proceeds later converted to Ethereum.

A separate THORChain refund arrived after the initial sweep, adding ATOM that fell outside the recovery transaction. An earlier attempt to move 500,000 ATOM failed due to insufficient funds for the transaction fee.

Next Steps for Neutron and Asset Return

Neutron developers are preparing a new binary to restore the compromised contracts, tighten governance controls, and move remaining attacker‑controlled assets into a validator multisig. The project aims to restart within roughly 24 hours, after which recovered funds are expected to be returned to their original contracts and users.

Cosmos Hub will issue a forum update detailing the secured ATOM and coordinate with validators and affected protocols to reconcile the recovered balance against the portion that escaped.