Cosmos Hub Restarts After 24-Hour Halt; 1.23 Million ATOM Pulled From Neutron Attacker Wallet
Cosmos Hub back online, 1.23 million ATOM pulled from attacker's wallet
The Cosmos Hub resumed producing blocks at 8:06 a.m. ET on Wednesday, September 23, after going quiet for 24 hours and 48 minutes. At the moment of restart, a transfer of 1.23 million ATOM moved out of the wallet of the attacker who had taken over 11 Neutron contracts through a governance vote.
The Neutron chain remains down. It stopped producing blocks at 7:43:55 a.m. UTC on September 22 and had not restarted as of the time of reporting, leaving a gap of more than 35 hours.
The numbers behind the takeover
- The attacker submitted Neutron proposal 9, titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration," which went on-chain at 10:24 p.m. ET on September 18.
- A second address bought NTRN (Neutron's governance token) in five transactions on the Astroport decentralized exchange for a combined 20,199 USDC.
- That address delegated 31.6 million NTRN just 11 minutes and 39 seconds before the vote closed at 10:24 p.m. ET on September 21.
- The proposal passed with 82% support (37.3 million NTRN in favor, 8.09 million against) against an expedited threshold of 67%.
- All 11 messages in the proposal reassigned the admin rights of 11 Neutron contracts to the proposer's address.
- The attacker uploaded malicious contract code (code ID 5399) just over an hour before the vote closed.
- The first contract migration landed 13 minutes after voting ended; the last, 24 minutes later, with fund withdrawals interleaved between them.
What was stolen and what remains frozen
Spaydh, who announced Neutron's move to long-term support mode in March, put the total impact at roughly $4.4 million. The breakdown: about $3 million in ATOM, about $1.2 million in USDC, roughly $100,000 in dYdX, about $50,000 in wstETH, and about $16,000 in WETH.
He said about 70% of the stolen ATOM sat on the Cosmos Hub when it halted, putting the expected net loss "closer to $2.2M."
The attacker's Neutron address remains frozen with the chain. It holds 1.67 million USDC, 96.2 million NTRN, 370 million ASTRO, and 1.59 million dATOM. Spaydh said Neutron's rate limits and the halt "safeguarded more than $1.6M worth of USDC, as well as large amounts of NTRN and ASTRO tokens."
How the attacker moved funds after the takeover
At 5:05 a.m. ET on September 22, the attacker sent 200,000 ATOM into a THORChain vault with a memo instructing a streaming swap into ether for delivery to an Ethereum address. The Cosmos Hub halt cut that swap short. When the Hub restarted, the vault returned 168,991 ATOM to the attacker 75 seconds later with a refund memo referencing the original deposit.
Two minutes after the refund, the attacker attempted to move 500,000 ATOM to Osmosis. The transaction failed for insufficient funds. A second attempt at 1:54 p.m. ET sent the refunded 168,990 ATOM to an Osmosis address controlled by the same key, with a timeout height that Osmosis had already passed three minutes earlier. The ATOM had not appeared on Osmosis as of 3:09 p.m. ET.
The Ethereum address named in the original swap memo holds 94.4 ETH, worth roughly $252,000, and no stablecoins.
Cosmos Hub says the Hub itself was not exploited
The Cosmos Hub stated on X that the network "has been successfully restarted by validators on schedule" and that "block production has resumed, and operations are normal." It also said the Hub itself was not exploited and that "no funds were impacted apart from the assets moved from Neutron."
The Hub's most recent governance proposal, 1055, passed on September 20 and covers the Gaia v28.2.0 software upgrade. Validators coordinated the halt and restart among themselves.
The transfer of 1.23 million ATOM is recorded in the finalization events of block 33,086,741, the last block the Hub produced before it stopped. No transaction in that block carries it. The receiving address, cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64, had no registered public key and a sequence number of zero, meaning it had never sent a transaction before receiving those funds.
Spaydh said Cosmos Hub contributors and validators worked to transfer the stolen ATOM to a validator multisig as part of the restart, so it can be returned to original addresses once Neutron is back online.
What is next for Neutron
CryptoCrew, which also trades under the name Solva, has built a new Neutron binary. It reverts the affected contracts to their original code and admin settings, curtails governance, and transfers the attacker's funds to a validator multisig, according to Spaydh.
He said the binary was in review on Tuesday and that Neutron was "tentatively expected to resume producing blocks within 24 hours," with recovered assets returned that week. A post-mortem is expected once the chain restarts.
CryptoCrew was named Neutron's security maintainer through governance proposal 4, which passed on August 21. That proposal funds the mandate with $28,568 from the community pool for up to 12 months, covering vulnerability intake, patch releases, critical dependency fixes, and operator coordination.
Why the chain was already fragile
Neutron had been in a wind-down phase since March, when Spaydh described the decision to move it to long-term support as "incredibly difficult." The Neutron foundation deprecated its front ends on June 30 and handed public node, archive, snapshot, and relayer infrastructure to CryptoCrew on June 18.
Spaydh clarified that he and his team were no longer involved with Neutron since the transition and that they "participated in the incident response merely as community members."
Neutron's tracked total value locked across chains stood at $18,500, according to DefiLlama. NTRN carried a market value of about $314,000 on 24-hour volume of $5.45, according to CoinGecko.
ATOM traded through the halt without breaking its weekly range
ATOM fell 4.9% over 24 hours and was up 14% over seven days, for a market value of roughly $908 million. It traded through the halt period without breaking its weekly range, and its low for the week came on Wednesday afternoon, hours after the Hub came back online.
This is the second disruption to Cosmos chains in two months. In August, Cosmos Labs urged every public chain running its EVM module below version 0.6.2 to halt.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.