Cosmos Hub restarted block production on September 23 after a network halt lasting nearly 24 hours, executing a recovery operation that transferred 1,227,121.37 ATOM—valued at approximately $2.2 million—from an attacker-linked address to a recovery wallet.
The intervention followed stolen funds from Neutron being moved to Cosmos Hub. Cosmos Hub stated its own network was not exploited and that the halt was designed to secure bridged assets before they could be transferred further.
The Attack and Initial Damage
The attack began on Neutron when an attacker accumulated sufficient voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts. These contracts supported protocols including Astroport and Drop and were then modified with malicious code enabling unauthorized asset withdrawals.
The initial impact was estimated at approximately $4.4 million, comprising around $3 million in ATOM, $1.2 million in USDC, approximately $100,000 in DYDX, and smaller amounts of wstETH and WETH. Neutron's rate limits and subsequent network halt prevented some assets from leaving the network, protecting more than $1.6 million in USDC along with significant amounts of NTRN and ASTRO tokens.
Recovery Operation and Escaped Funds
Roughly 70% of the stolen ATOM remained on Cosmos Hub when validators halted block production. The restart executed the recovery transaction at block 33,086,741, securing most stranded ATOM by transferring it into a community validator multisig.
However, a gap emerged when a subsequent refund from THORChain reached the attacker-linked address seven blocks after the restart. According to crypto analyst Rarma, 168,990.9 ATOM arrived at the address after the recovery transaction had already completed. The tokens remained there for approximately six hours before being transferred to Osmosis and sold in batches for about 266,841 USDC, with proceeds subsequently converted into Ethereum.
Cosmos Hub has not publicly explained why the later transfer proceeded or whether additional restrictions were intended for funds reaching the address following the initial sweep.
Next Steps
The recovered ATOM remains under community control pending coordination among Hub validators, Neutron participants, and affected protocols on their return. Neutron contributors prepared a new binary to restore affected contracts to their previous code and administrators while tightening governance controls. Neutron targeted a restart within approximately 24 hours of the Cosmos Hub restart, with asset returns expected to begin afterward. The project planned to publish a full post-mortem once the chain resumed block production.
