{ "version": 1, "event_id": "evt_30c06aaf6dbebbc2", "url": "https://xiyu.news/events/evt_30c06aaf6dbebbc2/", "json": "https://xiyu.news/api/events/evt_30c06aaf6dbebbc2.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "Cosmos Hub 恢复出块；123 万枚 ATOM 从 Neutron 攻击者钱包转出", "en": "Cosmos hub halts for 24 hours after Neutron governance attack" }, "current_state": { "zh": "Cosmos Hub已在约25小时停块后重启，并从攻击者关联地址扫走1.23百万ATOM（约220万美元），转入社区验证者多签；但168,990.9 ATOM在扫款后经THORChain退款到达攻击者地址并逃逸，最终在Osmosis卖出约266,841 USDC；Neutron正筹备重启并归还恢复资金。", "en": "Cosmos Hub restarted after a nearly 25-hour halt and swept 1.23M ATOM (~$2.2M) from an attacker-linked address into a community validator multisig; however, 168,990.9 ATOM arrived after the sweep via a THORChain refund, escaped recovery, and was sold on Osmosis for about 266,841 USDC; Neutron is preparing to restart and return recovered funds." }, "first_seen_at": "2026-09-23T17:21:31.878864+00:00", "last_updated_at": "2026-09-24T17:26:43.553611+00:00", "last_material_change_at": "2026-09-24T17:26:43.553611+00:00", "confidence": 0.75, "updates_count": 3, "sources_count": 3, "entities": [ "atom", "attacker", "cosmos", "from", "governance-attack", "hub", "million", "moved", "neutron", "restarts", "wallet" ], "identifiers": [], "topics": [ "atom", "chain-halt", "cosmos", "defi-exploit", "governance-attack", "neutron", "protocol-security" ], "updates": [ { "update_id": "upd_6d5655698145634c", "event_id": "evt_30c06aaf6dbebbc2", "occurred_at": "2026-09-23T14:31:02Z", "published_at": "2026-09-23T14:31:02Z", "first_seen_at": "2026-09-23T17:21:31.878864Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Neutron治理攻击后Cosmos Hub停机24小时", "title_en": "Cosmos hub halts for 24 hours after Neutron governance attack", "what_changed_zh": "在Neutron上一项恶意的“AI Agent Takeover”治理提案通过后，Cosmos Hub验证者停止出块超过24小时，使攻击者得以控制Astroport和Drop应用并掏空合约，在周三恢复出块前，约950万美元受影响资产中约20%已被提取。", "what_changed_en": "Cosmos Hub validators halted block production for more than 24 hours after a malicious 'AI Agent Takeover' governance proposal passed on Neutron, allowing an attacker to take control of the Astroport and Drop applications and drain contracts, with about 20% of the ~$9.5M in affected assets extracted before block production resumed on Wednesday.", "current_state_zh": "在Neutron上一项恶意的“AI Agent Takeover”治理提案通过后，Cosmos Hub验证者停止出块超过24小时，使攻击者得以控制Astroport和Drop应用并掏空合约，在周三恢复出块前，约950万美元受影响资产中约20%已被提取。", "current_state_en": "Cosmos Hub validators halted block production for more than 24 hours after a malicious 'AI Agent Takeover' governance proposal passed on Neutron, allowing an attacker to take control of the Astroport and Drop applications and drain contracts, with about 20% of the ~$9.5M in affected assets extracted before block production resumed on Wednesday.", "detailed_summary_zh": "Cosmos Hub validators halted block production for more than 24 hours after a malicious 'AI Agent Takeover' governance proposal passed on Neutron, allowing an attacker to take control of the Astroport and Drop applications and drain contracts, with about 20% of the ~$9.5M in affected assets extracted before block production resumed on Wednesday.", "detailed_summary_en": "Cosmos Hub validators halted block production for more than 24 hours after a malicious 'AI Agent Takeover' governance proposal passed on Neutron, allowing an attacker to take control of the Astroport and Drop applications and drain contracts, with about 20% of the ~$9.5M in affected assets extracted before block production resumed on Wednesday.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:protos.com_feed_:01f1204459ebd508" ], "sources": [ { "url": "https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_67714635bc88cb11", "event_id": "evt_30c06aaf6dbebbc2", "occurred_at": "2026-09-23T19:54:30Z", "published_at": "2026-09-23T19:54:30Z", "first_seen_at": "2026-09-23T23:02:35.843748Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Cosmos Hub 恢复出块；123 万枚 ATOM 从 Neutron 攻击者钱包转出", "title_en": "Cosmos Hub Restarts; 1.23 Million ATOM Moved From Neutron Attacker Wallet", "what_changed_zh": "Cosmos Hub 在停块24小时48分钟后恢复出块；1.23百万ATOM从Neutron攻击者钱包转出；该攻击者钱包用20,199 USDC购买投票权，并在加速提案关闭前12分钟完成质押。", "what_changed_en": "Cosmos Hub resumed producing blocks after a 24-hour-48-minute halt; 1.23 million ATOM moved from the Neutron attacker wallet; the attacker wallet purchased voting power with 20,199 USDC and staked it 12 minutes before the expedited proposal closed.", "current_state_zh": "Cosmos Hub 已在停块24小时48分钟后恢复出块；与Neutron治理攻击相关的攻击者钱包转出1.23百万ATOM，该钱包曾用20,199 USDC购买投票权并在加速提案关闭前12分钟质押。", "current_state_en": "Cosmos Hub has resumed producing blocks after a 24-hour-48-minute halt; 1.23 million ATOM moved from the Neutron attacker wallet tied to the governance attack, which had purchased voting power with 20,199 USDC and staked it 12 minutes before the expedited proposal closed.", "detailed_summary_zh": "Cosmos Hub resumed producing blocks after a 24-hour-48-minute halt, while 1.23 million ATOM moved from a Neutron attacker wallet that had purchased voting power with 20,199 USDC and staked it 12 minutes before an expedited proposal closed.", "detailed_summary_en": "Cosmos Hub resumed producing blocks after a 24-hour-48-minute halt, while 1.23 million ATOM moved from a Neutron attacker wallet that had purchased voting power with 20,199 USDC and staked it 12 minutes before an expedited proposal closed.", "background_zh": "Cosmos Hub 是基于 CometBFT、Cosmos SDK 和 IBC 构成的跨链技术栈上的第一条互连区块链，ATOM 是其质押资产。Neutron 是一个由 Cosmos Hub 提供安全保障的智能合约平台，因此 Hub 层面的出块与治理状况与 Neutron 直接相关。加急提案是指在缩短的时间表内进行的治理投票。", "background_en": "Cosmos Hub is the first of the interconnected blockchains built on the interchain stack of CometBFT, Cosmos SDK and IBC, and ATOM is the network's staking asset. Neutron is a smart-contract platform that is secured by the Cosmos Hub, which makes Hub-level block production and governance relevant to Neutron. Expedited proposals are governance votes run on a shortened timeline.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件牵涉 ATOM 的质押与治理，以及依赖 Cosmos Hub 提供安全保障的 Neutron；123 万枚 ATOM 的转移属于市场会关注的供给端流动。潜在影响主要通过治理公信力相关的市场情绪以及 ATOM 的流动性传导，而非来自协议基本面的改变。", "market_impact_en": "The episode touches ATOM staking and governance as well as Neutron, which relies on the Hub for security, while the relocation of 1.23 million ATOM is a supply-side flow that venues will track; any effect would transmit through sentiment around governance integrity and through ATOM liquidity rather than through a change in protocol fundamentals.", "importance_score": 8.5, "references": [ { "url": "https://docs.cosmos.network/hub/latest", "title": "Introduction - Cosmos Docs" }, { "url": "https://www.binance.com/en/research/projects/neutron", "title": "Neutron (NTRN)" }, { "url": "https://coinmarketcap.com/currencies/cosmos/", "title": "Cosmos price today, ATOM to USD live price, marketcap and chart | CoinMarketCap" } ], "confidence": 0.96, "story_ids": [ "rss:thedefiant.io_api_feed:9ff491bad7b25de9" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/cosmos-hub-restarts-1-23-million-atom-moved-from-neutron-attacker-wallet", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_813e96553a9f1dc7", "event_id": "evt_30c06aaf6dbebbc2", "occurred_at": "2026-09-24T11:20:49Z", "published_at": "2026-09-24T11:20:49Z", "first_seen_at": "2026-09-24T17:26:43.553611Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Cosmos重启以扣押220万美元被盗ATOM，但仍有169,000枚代币逃脱", "title_en": "Cosmos restarted to seize $2.2 million in stolen ATOM, but 169,000 tokens still escaped", "what_changed_zh": "新增关键事实：在Cosmos Hub重启并扫走1.23百万ATOM后，168,990.9 ATOM因THORChain退款在七个区块后到达攻击者关联地址，未在恢复交易中被拦截，随后被转入Osmosis分批卖出约266,841 USDC并部分换成ETH；此外，攻击初始损失估计约440万美元，Neutron正筹备重启并恢复受影响合约。", "what_changed_en": "New material facts: after Cosmos Hub restarted and swept 1.23M ATOM, 168,990.9 ATOM arrived at the attacker-linked address seven blocks later via a THORChain refund, escaped the recovery transaction, and was moved to Osmosis and sold in batches for about 266,841 USDC, partly converted to ETH; the initial attack impact was estimated at roughly $4.4M, and Neutron is preparing to restart and restore affected contracts.", "current_state_zh": "Cosmos Hub已在约25小时停块后重启，并从攻击者关联地址扫走1.23百万ATOM（约220万美元），转入社区验证者多签；但168,990.9 ATOM在扫款后经THORChain退款到达攻击者地址并逃逸，最终在Osmosis卖出约266,841 USDC；Neutron正筹备重启并归还恢复资金。", "current_state_en": "Cosmos Hub restarted after a nearly 25-hour halt and swept 1.23M ATOM (~$2.2M) from an attacker-linked address into a community validator multisig; however, 168,990.9 ATOM arrived after the sweep via a THORChain refund, escaped recovery, and was sold on Osmosis for about 266,841 USDC; Neutron is preparing to restart and return recovered funds.", "detailed_summary_zh": "Cosmos Hub restarted after a nearly 25-hour halt, sweeping 1.23 million ATOM worth about $2.2 million linked to the Neutron governance exploit, but 168,990 ATOM escaped the recovery.", "detailed_summary_en": "Cosmos Hub restarted after a nearly 25-hour halt, sweeping 1.23 million ATOM worth about $2.2 million linked to the Neutron governance exploit, but 168,990 ATOM escaped the recovery.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.95, "story_ids": [ "rss:cryptoslate.com_feed_:f96ea5c094e083fc" ], "sources": [ { "url": "https://cryptoslate.com/cosmos-restarted-to-seize-2-2-million-in-stolen-atom-but-169000-tokens-still-escaped/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] } ] }