Neutron DAO Governance Changes Followed by $9.3 Million Loss
Astroport and Drop hit by multi-million dollar incident
On September 22, voters in the Neutron decentralized autonomous organization (DAO)—a community-led group that governs the network—passed a proposal to update administrative controls for 11 software contracts. On the same day, security researchers reported that two applications built on the network, Astroport and Drop, suffered estimated losses totaling $9.3 million.
The incident has raised questions about how much control a network's governance system has over the individual applications users interact with. While many people see these applications as separate services, the Neutron DAO retains the authority to change the administrators of the software contracts they host.
Key facts about the Neutron incident
- Neutron DAO passed proposal #9, authorizing 11 "Update Admin" actions on the network.
- Astroport suffered an estimated loss of $4.9 million.
- Drop suffered an estimated loss of $4.4 million.
- Approximately 20% of the affected funds were extracted by the attacker before network activity was stopped.
The role of administrative updates
The approved proposal, titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration," allowed the network to change who has control over specific contracts. According to official documentation, the Neutron DAO is the highest authority on the network. This means it can execute messages that change the management of applications like Astroport and Drop, even if users perceive those apps as independent.
Confirmed details of the financial impact
Security tracker SlowMist confirmed the combined loss estimate of $9.3 million. Following the incident, network halts were used to prevent the attacker from moving more assets. These halts successfully stranded a large portion of the affected funds within the network, though roughly one-fifth of the total value was moved by the attacker before the freeze took effect.
Uncertainty remains over fund recovery
It is currently unclear how much of the $9.3 million can be recovered and returned to affected users. While many assets are currently held in place by the network halt, they have not yet been restored to their original owners. The final loss will depend on whether the contained assets can be safely moved back to user accounts.
Why this matters for crypto users
This event demonstrates that the governance of a main blockchain network can have significant power over the applications running on top of it. Users of decentralized finance applications often assume these services are fully independent, but this incident shows that network-level decisions can directly impact the security and management of user funds.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.