Cosmos Hub Halts Chain to Recover 1.227 Million Stolen ATOM Transferred to Multisig
Cosmos Labs disclosed that on September 22, Neutron suffered a governance attack, causing liquidity from protocols like Astroport to be drained, with approximately 1.73 million ATOM transferred to Cosmos Hub via IBC. The Hub itself was not breached, and user funds were unaffected. Validators halted the chain at block height 33086740 for about 24.5 hours, resuming block production on September 23 with the patched Gaia v28.3.0.
Upon restart, a one-time state change was made at the halt height, transferring the remaining 1,227,121 ATOM from the attacker's address to a 4/6 multisig cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64, with signers including Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu, only modifying this account. Approximately 500,000 ATOM had already been exchanged for ETH via THORChain before the halt and could not be recovered; another 168,990.9 ATOM returned to the attacker's address after a THORChain refund post-restart and were immediately sold on Osmosis.
The attack path involved Neutron using a false pretext to gain administrative rights over about 10 contracts, including Astroport and Drop, through a governance proposal, then replacing the code to empty the funds. On-chain reconstruction shows that the account leading the favorable votes purchased about 31.6 million NTRN with approximately 20,199 USDC and staked it about 12 minutes before the voting ended. Estimated losses for the protocol range from $4.4 million to $9.4 million, while Neutron itself still has about $5 million in locked assets.
ATOM in the multisig cannot be staked, lent, or traded and must wait for authorization from a Cosmos Hub governance proposal to be returned. The Neutron team expects to submit a recovery plan and related proposals next week. Validators received a written plan about 3.5 hours after the halt: the scope of changes, source and target addresses, and six signers, followed by a patch.
In market mechanics, this is an interception of cross-chain illicit funds. The seller is the attack address eager to exchange ATOM for ETH; the buyer is the counterparty on THORChain and Osmosis. Funds entered the Hub from the Neutron application layer via IBC and were then diverted for cross-chain exchange. The halt rewrote the 1.227 million ATOM that had not yet exited from the attacker's account to the community multisig, effectively using the consensus layer to veto an already recorded IBC transfer. Beneficiaries are the liquidity providers for Astroport and Drop who can still reclaim their shares through governance; the pressured parties are the validators' delegations and cross-chain bridge users who could not settle ATOM within the 24.5-hour halt. The governance proposal becomes the gateway for re-pricing this batch of coins.
Source: Public Information
ABAB AI Insight
Neutron used approximately $20,000 worth of NTRN to buy administrative rights during the proposal window, indicating that application chains place contract upgrade rights into on-chain governance, making the spot market for voting tokens the attack budget. The Hub had no vulnerabilities but halted for the purpose of recovering illicit funds, rewriting a single account in the first block after restart. This transforms "code is law" into "the validator collective can change the state for a piece of illicit funds," provided that the written plan precedes the patch and only modifies one address.
The capital path is divided into three segments: the 500,000 ATOM exchanged for ETH left the Cosmos settlement circle; the 169,000 ATOM sold after the refund proves that the halt window still leaked; and the 1.227 million ATOM frozen by the multisig, with value fluctuating with ATOM's spot price, with disposal rights handed to Hub governance. The 4/6 structure from Nansen to Polkachu changes the recovery of illicit funds from a single signature by the project party to a community of validators. Neutron will submit a plan next week, effectively applying to the Hub to act as a clearing court.
Similar operations have been seen in the Ethereum DAO fork and some application chains rolling back hacker transactions. The current phase is that the IBC hub begins to assume the function of freezing illicit funds from downstream application chains. Application chains that can buy voting rights within 12 minutes are in a position to be taken over by governance; the Hub, which can coordinate a halt within two hours, treats its consensus as the final custodianship.
Structural judgment belongs to regulatory changes occurring at the protocol level. Without external courts, validators exercise freezing rights through halting blocks and state patches. The mechanism is: when illicit funds are stopped in the Hub account and have not yet entered irreversible exchanges, consensus runs faster than contracts. Pricing rights shift from the attacker's shipping address to the multisig and subsequent governance proposals. Whoever can gather 2/3 of the validators to halt the chain temporarily possesses the disposal rights of cross-chain illicit funds.
ABAB News · Cognitive Laws
Governance tokens can be bought in the spot market, thus administrative rights have a price.
The Hub's halt treats consensus as a freezing order.
Coins exchanged out cross-chain cannot be reclaimed through governance.