Current outcome
Cosmos Hub restarted after a nearly 25-hour halt and swept 1.23M ATOM (~$2.2M) from an attacker-linked address into a community validator multisig; however, 168,990.9 ATOM arrived after the sweep via a THORChain refund, escaped recovery, and was sold on Osmosis for about 266,841 USDC; Neutron is preparing to restart and return recovered funds.
Progress timeline
3 material updates- #01
Cosmos hub halts for 24 hours after Neutron governance attack
Cosmos Hub validators halted block production for more than 24 hours after a malicious 'AI Agent Takeover' governance proposal passed on Neutron, allowing an attacker to take control of the Astroport and Drop applications and drain contracts, with about 20% of the ~$9.5M in affected assets extracted before block production resumed on Wednesday.
Source evidence: Protos
- #02
Cosmos Hub Restarts; 1.23 Million ATOM Moved From Neutron Attacker Wallet
Cosmos Hub resumed producing blocks after a 24-hour-48-minute halt; 1.23 million ATOM moved from the Neutron attacker wallet; the attacker wallet purchased voting power with 20,199 USDC and staked it 12 minutes before the expedited proposal closed.
State after update: Cosmos Hub has resumed producing blocks after a 24-hour-48-minute halt; 1.23 million ATOM moved from the Neutron attacker wallet tied to the governance attack, which had purchased voting power with 20,199 USDC and staked it 12 minutes before the expedited proposal closed.
Source evidence: The Defiant
- #03
Cosmos restarted to seize $2.2 million in stolen ATOM, but 169,000 tokens still escaped
New material facts: after Cosmos Hub restarted and swept 1.23M ATOM, 168,990.9 ATOM arrived at the attacker-linked address seven blocks later via a THORChain refund, escaped the recovery transaction, and was moved to Osmosis and sold in batches for about 266,841 USDC, partly converted to ETH; the initial attack impact was estimated at roughly $4.4M, and Neutron is preparing to restart and restore affected contracts.
State after update: Cosmos Hub restarted after a nearly 25-hour halt and swept 1.23M ATOM (~$2.2M) from an attacker-linked address into a community validator multisig; however, 168,990.9 ATOM arrived after the sweep via a THORChain refund, escaped recovery, and was sold on Osmosis for about 266,841 USDC; Neutron is preparing to restart and return recovered funds.
Source evidence: CryptoSlate