Cosmos Labs disclosed that on September 22, Neutron suffered a governance attack, causing liquidity from protocols like Astroport to be drained, with approximately 1.73 million ATOM transferred to Cosmos Hub via IBC. The Hub itself was not breached, and user funds were unaffected. Validators halted the chain at block height 33086740 for about 24.5 hours, resuming block production on September 23 with the patched Gaia v28.3.0.

Upon restart, a one-time state change was made at the halt height, transferring the remaining 1,227,121 ATOM from the attacker's address to a 4/6 multisig cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64, with signers including Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu, only modifying this account. Approximately 500,000 ATOM had already been exchanged for ETH via THORChain before the halt and could not be recovered; another 168,990.9 ATOM returned to the attacker's address after a THORChain refund post-restart and were immediately sold on Osmosis.

The attack path involved Neutron using a false pretext to gain administrative rights over about 10 contracts, including Astroport and Drop, through a governance proposal, then replacing the code to empty the funds. On-chain reconstruction shows that the account leading the favorable votes purchased about 31.6 million NTRN with approximately 20,199 USDC and staked it about 12 minutes before the voting ended. Estimated losses for the protocol range from $4.4 million to $9.4 million, while Neutron itself still has about $5 million in locked assets.

ATOM in the multisig cannot be staked, lent, or traded and must wait for authorization from a Cosmos Hub governance proposal to be returned. The Neutron team expects to submit a recovery plan and related proposals next week. Validators received a written plan about 3.5 hours after the halt: the scope of changes, source and target addresses, and six signers, followed by a patch.

In market mechanics, this is an interception of cross-chain illicit funds. The seller is the attack address eager to exchange ATOM for ETH; the buyer is the counterparty on THORChain and Osmosis. Funds entered the Hub from the Neutron application layer via IBC and were then diverted for cross-chain exchange. The halt rewrote the 1.227 million ATOM that had not yet exited from the attacker's account to the community multisig, effectively using the consensus layer to veto an already recorded IBC transfer. Beneficiaries are the liquidity providers for Astroport and Drop who can still reclaim their shares through governance; the pressured parties are the validators' delegations and cross-chain bridge users who could not settle ATOM within the 24.5-hour halt. The governance proposal becomes the gateway for re-pricing this batch of coins.

Source: Public Information