Overview
- A malicious Neutron governance proposal let an attacker take assets that were routed to multiple chains, and roughly 1.73 million ATOM reached the Cosmos Hub during the Sep. 22 exploit.
- Validators representing enough voting power halted the Hub and then restarted it with a one‑time Gaia v28.3.0 update that moved 1,227,121.37 ATOM into a multisignature wallet requiring four of six validator signers.
- About 500,000 ATOM had already been swapped for ETH through THORChain before the halt and cannot be recovered through the Hub update, and roughly 168,990.9 ATOM returned after the restart then moved to Osmosis and was sold.
- Cosmos Labs shared attacker addresses with more than 30 exchanges, bridges, and custodians and said several have blocked those addresses while the six multisig signers agreed to hold the recovered ATOM without staking or trading it.
- The Neutron recovery team plans to publish a postmortem and submit a Cosmos Hub governance proposal to decide the fate of the secured ATOM, and the outcome will determine which funds can be returned to victims and which are permanently lost.