Cosmos Hub Halted After Validators Pause Chain Over Stolen Assets

A major incident was averted on the Cosmos Hub network after an almost 25-hour halt. During this time, validators paused their own chain and restarted it with a limited state change that affected only one account.

The action may have helped Neutron victims by moving 1,227,121 ATOM from an attacker-linked address into recovery custody. However, the incident highlights the complexities of blockchain finality and the need for clear communication during emergencies.

The Cosmos Hub's incident update emphasizes that its network was not exploited, but rather it was the validators who paused their own chain in response to stolen assets arriving via IBC from Neutron. The restart on Gaia v28.3.0 included a one-time state change at block height 33,086,741.

It's essential to note that halting one network does not cancel activity already pending elsewhere. In this case, the incident showed why recovery teams must map pending swaps, bridge transfers, wrapped tokens, and exchange deposits alongside the balance visible on the chain they control.