Cosmos Hub Secures Stolen Tokens After Neutron Governance Attack

The Cosmos Hub was hit by a governance attack on Neutron, resulting in the theft of over 1.73 million ATOM.

The attackers used a malicious proposal to gain control over contracts used by Astroport and other protocols, causing the stolen assets to be sent to various chains, including the Cosmos Hub.

Validators representing more than one-third of the Hub's voting power stopped their nodes, bringing the network to a halt at block 33,086,740. A patched software update was prepared, identifying the attacker's address, the destination wallet, and the six proposed signers.

The validators installed the patch and restarted the network on September 23rd, moving 1.23 million ATOM to a recovery wallet controlled by six community validators. The remaining 500,000 ATOM had already been swapped for ETH through THORChain before the halt and could not be recovered.