Neutron Governance Attack: Cosmos Hub Response and Recovery Update

Edit: Sep 29 - Added link to Neutron’s post-mortem publication Overview On September 22, 2026, a governance attack on Neutron drained liquidity from Astroport and other protocols on that network. Before Neutron halted, the attacker bridged the stolen assets to a variety of chains, and a portion of the stolen assets, roughly 1.7M ATOM, were bridged to the Cosmos Hub. The Cosmos Hub itself was not exploited. No Hub user funds were affected. Hub validators halted the network at height 33,086,740 to stop the remaining ATOM from leaving and being lost. Roughly 24 hours later, they restarted on a patched Gaia binary (v28.3.0) that applied a single, one-time change at the halt height, moving 1,227,121 ATOM from the attacker’s address into a 4-of-6 multisig created to aid recovery of the funds and held by community validators (cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64). Block production resumed at 12:00 UTC on September 23. This post covers the Hub side only: what funds arrived at the Hub, what validators did, where the funds are, and how next steps will be coordinated. The complete post-mortem of the attack has been published by Neutron’s maintainers . Cosmos Labs is…

Excerpt (1197 of 15484 characters). Read the whole post on the forum ↗

On behalf of the Neutron community, we want to thank the Cosmos Hub’s contributors and validators for how they handled this situation. The Hub was not the target of this attack, but it acted fast to limit the damage to the ATOM token and the wider Cosmos ecosystem. Validators coordinated an emergency halt within hours and shipped a minimal, carefully scoped restart on Gaia v28.3.0. As a result, 1,227,121 ATOM that would otherwise have been sold is now safe in custody. Thank you also to Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu for taking on custody as signers of the recovery multisig. As the team leading the Neutron relaunch, we have just posted a proposal for discussion: [DISCUSSION] Move the 1,227,121 ATOM recovered after the Neutron exploit to the Neutron recovery multisig In short, it is a text proposal that would authorize the Hub multisig signers to send the recovered ATOM over IBC to the Neutron recovery multisig. After that, a Neutron governance proposal will return all recovered funds, including this ATOM, to the original contracts they were taken from. The proposal spends nothing from the community pool and changes nothing on the Hub. We’d appreciate…

Excerpt (1197 of 1287 characters). Read the whole post on the forum ↗