Cosmos Hub Recovers Millions in Stolen Tokens After Restart

The Cosmos Hub network was successfully restarted after validators halted block production for nearly 25 hours to recover stolen assets.

Approximately $2.2 million in ATOM tokens, which is around 1.22 million units, were recovered from the address linked to the attacker and transferred to a validator multisig wallet for restitution.

However, despite this success, 168,990.9 ATOM (around 169,000 tokens) managed to evade capture through a THORChain refund, which entered the attacker's address seven blocks after the restart. This amount was then sent to Osmosis and liquidated for around 266,841 USDC.

The incident is attributed to a governance exploit on the Neutron network, where the hacker accumulated voting power in NTRN tokens to pass an expedited proposal granting them administrative rights over critical smart contracts. These contracts were then migrated to malicious code, allowing unauthorized withdrawals of assets.

The recovery effort was a coordinated defensive action among validators, with Cosmos Hub confirming that its core infrastructure did not suffer any direct vulnerability. The network is now being monitored for further updates, and teams are working to reconcile balances and return the assets to their rightful owners.