TL;DR:
- Intervention and Recovery: After halting block production for nearly 25 hours, Cosmos Hub restarted at block 33,086,741, seizing 1,227,121.37 ATOM (approx. $2.2 million) held by an address linked to the attacker.
- Community Custody: The recovered funds were transferred to a validator multisig wallet to coordinate their restitution to affected contracts and users.
- Leaked Funds: Despite the initial capture, 168,990.9 ATOM entered the attacker’s address seven blocks after the restart via a THORChain refund, evading the sweep. The attacker transferred these funds to Osmosis and liquidated them for around 266,841 USDC, converting most into Ethereum (ETH).
Following a coordinated halt of nearly 25 hours, the Cosmos Hub network finally resumed block production. Validators decided to halt the chain to freeze and recover assets stemming from a governance exploit carried out against the Neutron network, thereby preventing them from dispersing across the ecosystem via inter-blockchain communication (IBC) bridges.
The Cosmos Hub network has been successfully restarted by validators on schedule; block production has resumed, and operations are normal.
The network will continue to be monitored; further updates will follow. https://t.co/xnoWWHWMst
— Cosmos Hub ⚛️ (@cosmoshub) September 23, 2026
In the first block after the restart (block 33,086,741), the updated software automatically executed the transfer of 1,227,121.37 ATOM (valued at approximately $2.2 million) from the address associated with the hacker to a recovery account. As confirmed by Cosmos Hub, its core infrastructure did not suffer any direct vulnerability; the measure was a coordinated defensive action among validators to secure the drained funds.
The Origin: Governance Exploit on Neutron
According to statements by Spaydh, a former contributor to Neutron, the incident was triggered when the hacker accumulated enough voting power in NTRN tokens to pass an expedited governance proposal. This maneuver granted them administrative rights over 11 critical smart contracts, including liquidity components and infrastructure from Astroport and Drop.
Once in control, the contracts were migrated to malicious code to allow the unauthorized withdrawal of assets. Although initial loss estimates ranged between $4.4 million and higher figures reported previously, withdrawal limits and the subsequent suspension of Neutron prevented the escape of more than $1.6 million in USDC, as well as significant amounts of NTRN and ASTRO tokens. Close to 70% of the stolen ATOM remained stranded within Cosmos Hub at the time of the block halt.
The Gap: A THORChain Refund Evaded the Seizure
Despite the success of the sweep executed in the first block, the operation left a window open. On-chain analyst Rarma detected that, just seven blocks after the restart, a refund originating from THORChain totaling 168,990.9 ATOM arrived at the same attacker address.
Because the rescue transaction only acted upon the balance present at the exact block of the restart, the newly received funds were not locked. The tokens remained in that address for nearly six hours before being sent via IBC to the Osmosis network, where the attacker sold them in several batches for approximately 266,841 USDC, subsequently converting the vast majority into Ethereum (ETH). Rarma also noted that an earlier transaction attempted to transfer 500,000 ATOM unsuccessfully due to insufficient balance, demonstrating that the address retained the ability to broadcast transfers across the network following the reactivation.
The more than 1.22 million recovered ATOM remain under the control of a Cosmos Hub validator multisig. Teams from Cosmos, Neutron, and the affected protocols are coordinating logistics to reconcile balances and return the assets to their rightful owners.
Meanwhile, Neutron developers are preparing a new binary to restart their chain, restore compromised contracts to their original versions, and tighten governance mechanisms to prevent similar attacks in the future.
