Cosmos Hub Recovers $2.2M in Stolen ATOM After Network Halt

Cosmos Hub's network halted for nearly a day after an attacker exploited a governance proposal on Neutron, allowing them to reassigned administrative rights over 11 smart contracts. The affected contracts included infrastructure used by Astroport and Drop.

The attacker-linked balance was moved into a recovery address before validators resumed block production on Sept. 23 at block 33,086,741. During the restart, 1,227,121.37 ATOM worth around $2.2 million were transferred from the attacker's address. However, about 169,000 ATOM escaped the recovery operation and were later sold for approximately 266,841 USDC.

Crypto analyst Rarma stated that an earlier attempt to transfer 500,000 ATOM failed due to insufficient funds in the wallet. He noted that the attacker-linked address could still submit IBC transfers after the restart.