[DISCUSSION] Move the 1,227,121 ATOM recovered after the Neutron exploit to the Neutron recovery multisig

TL;DR The Cosmos Hub recovery multisig holds 1,227,121.37 ATOM that was stolen from Neutron contracts on 22 September. We plan to submit a Hub text proposal that authorizes its signers to send this ATOM over IBC to the Neutron recovery multisig, `neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy`. A later Neutron governance proposal will then return all recovered funds, including this ATOM, to the original Neutron contracts they were taken from. The proposal spends nothing from the community pool, changes no Hub parameter, and executes no on-chain message. We would like feedback before submitting it. What happened On 22 September 2026 an attacker passed Neutron governance proposal 9 with stake bought for about 20,199 USDC. The proposal handed 11 Neutron contracts to the attacker, who replaced their code, emptied them and bridged the proceeds to other chains. All 1,723,180.29 ATOM taken went to the attacker’s address on the Cosmos Hub, `cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n`. The attacker had sold about 496,000 of it through THORChain and Osmosis by the time the Hub halted. Hub validators halted the chain at block 33,086,740. On 23 September the Hub restarted on Gaia…

Excerpt (1199 of 6550 characters). Read the whole post on the forum ↗

Why send Atom to a dead chain would be usefull ?

Thanks for the question, it’s a fair one. Neutron isn’t dead. It resumed block production on 25 September with a recovery release. That release put all 11 affected contracts back on their original code and admins, and locked both attacker accounts. The ATOM needs to go back because it belongs to Neutron users. It was taken from the Drop dATOM converter, the Drop withdrawal manager and the Astroport ATOM/dATOM pool. While it’s missing, those contracts can’t pay out what users are owed. Returning it to the original contracts lets those users withdraw their positions and offboard if they want to, including bridging their ATOM back to the Hub. Leaving it in a Hub multisig helps nobody. On whether this could happen again: the release closed the path proposal 9 used. For now, Neutron governance only accepts software-upgrade and text proposals, so a vote can no longer change contract admins, migrate contracts or move funds. New delegations are also frozen, so nobody can buy voting power the way the attacker did. The ongoing protections are enforced at several layers, which also covers calls made through smart contracts, interchain accounts and authz. The return itself also needs…

Excerpt (1198 of 1306 characters). Read the whole post on the forum ↗

Neutron will shutdown right ?

ccclaimens:

Leaving it in a Hub multisig helps nobody.

It would help if the community wants to use it via gov

The current plan is to keep the infrastructure running so users can offboard in an orderly way. That is also why the ATOM needs to go back to the original contracts: without it, Drop and Astroport users can’t withdraw what they are owed. On Solva’s side, we have committed to several months of repository and infrastructure maintenance (until 07/2027). What happens after that is up to Neutron’s validators and community.

It would help if the community wants to use it via gov

Technically, yes, the Hub community could vote to use the ATOM another way. But these funds aren’t unclaimed or ownerless. They belong to specific Drop and Astroport users on Neutron, whose ATOM was stolen out of those contracts. The Hub stopped the attacker from selling it, which is exactly what makes returning it possible.

So personally I’d strongly oppose any use other than returning it to its owners. But it’s a legitimate question, and that’s what this discussion is for. In the end it’s the Hub community’s vote.

Sharing my thoughts here quickly on this (purely as a Cosmos Hub community member. These views do not represent Cosmos Labs).

The ATOM in that multisig is toxic. Appropriating it for the Hub’s own use puts the entire community pool at risk of claims by impacted users on Neutron for years to come. We should keep it as far away from the Hub community pool as possible.

Imo, the funds should be sent back to the Neutron multisig so their community can deal with it accordingly, as the party that is best positioned to understand the needs of their own users.

Also, choosing not to keep funds out of the hands of the people it was stolen from is the morally right thing to do, so there’s that.

Why not take a snapshot of the ATOM holders on the Neutron side and return those ATOM to them on a Cosmos Hub address?

It makes sense, but people may not have known that Neutron was planning to shut down. They continued using the chain, remaining exposed to all the associated risks. We should migrate the Astroport contracts to the Hub and give those users a reason to move their DeFi activity to the Cosmos Hub instead.

Thanks for driving the next steps on this.

Personally, I’m aligned on the goal: get the funds to where the affected teams and the response team can coordinate restitution, close out the multisig and the Hub’s involvement as soon as possible to limit their exposure, and let users decide from there what they want to do with their assets.

What the protocols or Neutron do afterwards for wind-down is a separate matter and, in my view, out of scope here to try solve all at once.