Cosmos Labs said roughly 1.73 million ATOM was moved to Cosmos Hub after a governance attack on Neutron on Sept. 22 led to stolen liquidity from protocols including Astroport. Cosmos Hub itself was not compromised, and user funds were not affected. To stop further movement of the stolen tokens, Hub validators halted the network for about 24.5 hours and resumed block production on Sept. 23 using the patched Gaia v28.3.0 release. During the halt, 1.227 million ATOM remained in the attacker’s Hub address and was transferred, through a one-time state change at restart, into a 4-of-6 multisig controlled by Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Cosmos Labs added that about 500,000 ATOM had already been swapped for ETH through THORChain and could not be recovered, while another 169,000 ATOM entered the attacker’s address after the network resumed because of a THORChain refund, then was moved to Osmosis and sold. The recovered ATOM will stay in the multisig and can only be returned with authorization from a Cosmos Hub governance proposal.
Cosmos Labs said Neutron suffered a governance attack on Sept. 22, leading to stolen liquidity from protocols including Astroport. After the incident, about 1.73 million ATOM was moved by the attacker to Cosmos Hub.
Cosmos Hub itself was not attacked, and user funds were not affected.
Validators halted the network for about 24.5 hours
To prevent the stolen ATOM from being moved out again, Cosmos Hub validators halted the network for roughly 24.5 hours. Block production resumed on Sept. 23 after the chain restarted on the patched Gaia v28.3.0 release.
According to Cosmos Labs, 1.227 million ATOM remained in the attacker’s Hub address during the halt. When the network came back online, that balance was transferred through a one-time change into a 4-of-6 multisig wallet.
Six entities control the multisig
The multisig is made up of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. It currently holds about 1.227 million ATOM.
Cosmos Labs said the funds can only be returned after authorization through a Cosmos Hub governance proposal. Until then, the assets will not be staked, lent, or traded.
Part of the stolen funds is unrecoverable
Cosmos Labs said about 500,000 ATOM had already been swapped for ETH through THORChain and cannot be recovered.
Another 169,000 ATOM entered the attacker’s address after the network resumed because of a THORChain refund. Those tokens were then moved to Osmosis and sold.
Recovery plan expected next week
The Neutron team expects to submit a recovery plan and related governance proposal next week.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
