Neutron Governance Attack: Cosmos Hub Response and Recovery Update

Overview On September 22, 2026, a governance attack on Neutron drained liquidity from Astroport and other protocols on that network. Before Neutron halted, the attacker bridged the stolen assets to a variety of chains, and a portion of the stolen assets, roughly 1.7M ATOM, were bridged to the Cosmos Hub. The Cosmos Hub itself was not exploited. No Hub user funds were affected. Hub validators halted the network at height 33,086,740 to stop the remaining ATOM from leaving and being lost. Roughly 24 hours later, they restarted on a patched Gaia binary (v28.3.0) that applied a single, one-time change at the halt height, moving 1,227,121 ATOM from the attacker’s address into a 4-of-6 multisig created to aid recovery of the funds and held by community validators (cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64). Block production resumed at 12:00 UTC on September 23. This post covers the Hub side only: what funds arrived at the Hub, what validators did, where the funds are, and how next steps will be coordinated. The complete post-mortem of the attack is being prepared by Neutron’s maintainers , to be shared early next week. Cosmos Labs is publishing this update in its role as a…

Excerpt (1198 of 15412 characters). Read the whole post on the forum ↗