Cosmos Hub restarts after 24-hour halt tied to Neutron governance attack

Cosmos Hub goes quiet, then comes back

Validators on Cosmos Hub stopped producing blocks on Tuesday after a governance attack on Neutron, another blockchain in the Cosmos ecosystem. A blockchain records transactions in blocks, and validators are the operators who add those blocks.

Block production started again at 12:00 UTC on Wednesday, according to Protos. Cosmos Hub went offline at block height 33086740 and stayed down for more than 24 hours. Protos describes the incident as the third security scare for the wider Cosmos ecosystem in recent months.

Key numbers from the Neutron attack

• Losses from the attack were initially put at $9.5 million.
• The attacker was only able to extract around 20% of that. The rest stayed stuck on networks that had been halted.
• Assets worth $4.9 million were drained from Astroport and $4.4 million from Drop, two applications built on Neutron.
• The attacker reportedly spent just $20,199 to buy the NTRN tokens needed to pass the vote. NTRN is Neutron's token.
• Halting Cosmos Hub secured 1.2 million ATOM, worth over $2.2 million, held in the attacker's address. ATOM is Cosmos Hub's token.
• The attacker's Ethereum address holds $1.8 million.

How the governance vote was used

A proposal called "AI Agent Takeover" passed on Neutron. A governance vote lets token holders decide how a blockchain or its applications are run. Neutron entered what it called a "long-term maintenance phase" earlier this year.

Passing the proposal let the attacker take control of Astroport and Drop and drain assets from their contracts. The amounts taken from each are listed above.

What Cosmos Hub said

Cosmos Hub wrote on X that validators would restart the network at 12:00 UTC on September 23 (08:00 EDT). It added that "the Hub itself was not exploited and no funds were impacted apart from the assets moved from Neutron."

Neutron paused and funds caught in the halt

Neutron was paused in response to the attack, which trapped an estimated $5 million worth of assets. Cosmos Hub validators then decided to halt as well, which kept the 1.2 million ATOM in the attacker's address from moving.

The scheduled restart was set to include a queued refund of that trapped ATOM balance. A transaction worth over $300,000 was pending on THORChain and was set to be refunded to the Cosmos Hub address once the network restarted.

What is confirmed

• Cosmos Hub validators halted block production and the network resumed more than 24 hours later, at 12:00 UTC on Wednesday.
• The halt followed a governance attack on Neutron involving the Astroport and Drop applications.
• Cosmos Hub states that the Hub itself was not exploited and that no funds were affected apart from assets moved from Neutron.
• Neutron was paused and Cosmos Hub validators halted in response to the attack.

What is still unclear

The source does not identify who carried out the attack. The $20,199 figure for the NTRN tokens is described as reported, not confirmed by an official source, and the $5 million caught up in the Neutron pause is described as an estimate. The source also does not say whether all of the trapped assets will be recovered.

Why this matters for the Cosmos ecosystem

While Cosmos Hub was halted, the network could not process blocks, and those 1.2 million ATOM could not be moved by the attacker. The incident also shows how a governance vote, normally a routine way for token holders to make decisions, can be used to take control of applications when the tokens needed to pass a proposal are cheap to buy.

Earlier Cosmos security incidents this year

In late August, a bug in Cosmos Labs' Cosmos EVM module led to protocol-level exploits on four blockchains. KiiChain, one of the projects affected, criticised how the issue was disclosed and called the loss of $9 million worth of its KII tokens "avoidable."

Earlier in September, Cosmos-based exchange Osmosis said a June 25 exploit of Nomic's bridge had minted 40 nBTC, worth $3.6 million at the time, out of thin air. That left Osmosis' allBTC partially unbacked, at 36%.

Sources

• Protos