Cosmos Labs said Neutron suffered a governance attack on Sept. 22 that led to liquidity being drained from protocols including Astroport, with roughly 1.73 million ATOM later moved by the attacker to Cosmos Hub. Cosmos Hub itself was not compromised, and user funds on the Hub were not affected. To stop further outbound transfers of the stolen ATOM, Hub validators halted the network for about 24.5 hours and resumed block production on Sept. 23 using the patched Gaia v28.3.0 release. According to Cosmos Labs, 1.227 million ATOM remained in the attacker’s Hub address during the halt and was moved, through a one-time state change at restart, into a 4-of-6 multisig controlled by Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Cosmos Labs also said about 500,000 ATOM had already been swapped into ETH via THORChain and could not be recovered, while another 169,000 ATOM was refunded through THORChain after the network restart, returned to the attacker address, then moved to Osmosis and sold. The funds now held in the multisig cannot be returned unless authorized by a Cosmos Hub governance proposal, and they will not be staked, lent, or traded. Neutron said it expects to submit a recovery plan and related governance proposal next week.
Cosmos Labs said Neutron was hit by a governance attack on Sept. 22, leading to stolen liquidity from protocols including Astroport. About 1.73 million ATOM was then moved by the attacker to Cosmos Hub.
Cosmos Hub itself was not attacked, and user funds were not affected.
Hub validators halted the chain for about 24.5 hours
To prevent further transfers of the stolen ATOM, Cosmos Hub validators paused the network for roughly 24.5 hours. Block production resumed on Sept. 23 after the rollout of patched Gaia v28.3.0.
Cosmos Labs said 1.227 million ATOM remained in the attacker’s Hub address during the halt. When the network restarted, those funds were moved through a one-time change into a 4-of-6 multisig wallet.
Six entities control the multisig
The multisig includes Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. It currently holds about 1.227 million ATOM.
According to Cosmos Labs, the funds can only be returned after authorization through a Cosmos Hub governance proposal. The assets will not be staked, lent, or traded.
Some of the stolen ATOM is unrecoverable
Cosmos Labs said about 500,000 ATOM had already been swapped for ETH through THORChain and cannot be recovered. Another 169,000 ATOM was sent back to the attacker address as a THORChain refund after the network resumed, then transferred to Osmosis and sold.
The Neutron team expects to submit a recovery plan and a related governance proposal next week.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
