Cosmos Hub Recovers 1.227 Million ATOM from Neutron Attack, Funds Temporarily Held in 4/6 Multi-Signature Address

Cosmos Labs released a disclosure stating that on September 22, Neutron suffered a governance attack, resulting in the theft of liquidity from protocols including Astroport. Approximately 1.73 million ATOM were subsequently transferred by the attacker to the Cosmos Hub. The Cosmos Hub itself was not targeted in the attack, and user funds remained unharmed. To block the stolen ATOM from being further moved, Hub validators temporarily paused the network for roughly 24.5 hours, resuming block production on September 23 using the patched Gaia v28.3.0. Cosmos Labs added that during the pause, 1.227 million ATOM stayed in the attacker’s Hub address. Upon network recovery, these funds were transferred in a single operation to a 4/6 multi-sig address made up of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Earlier, around 500,000 ATOM had been swapped for ETH via THORChain and cannot be recovered. An additional 169,000 ATOM entered the attacker’s address via a THORChain refund after the network came back online, and were later transferred to Osmosis and sold. The multi-sig address currently holds approximately 1.227 million ATOM, which can only be returned following authorization via a Cosmos Hub governance proposal. The funds will not be staked, lent, or traded. The Neutron team is expected to submit a recovery plan and related governance proposal next week.