⏱ 3 min read
Funds sit in a six-signer recovery wallet; release awaits a separate Hub governance vote as Neutron prepares a distribution plan.
Cosmos Hub validators executed an emergency state change to seize 1,227,121.37 ATOM linked to the Sept. 22 Neutron governance attack, moving the tokens to a six-signer recovery wallet. The funds will not be released until a separate Hub governance proposal is approved, Cosmos Labs said on Sept. 25.
The incident began when a Neutron governance proposal granted the attacker administrative control over contracts used by Astroport and other protocols, according to Hub maintainers. The attacker routed some assets to other networks, including roughly 1.73 million ATOM to the Cosmos Hub. The Hub itself was not exploited; it became the venue where part of the stolen balance could be intercepted. Comparing the figures, 1,227,121.37 ATOM out of roughly 1.73 million implies about 71% of the ATOM that reached the Hub was recovered.
As the attacker swapped and bridged ATOM, validators halted the Hub at height 33,086,740 and agreed to restart on a patched Gaia binary (v28.3.0). At the first height after the halt, the patch performed a one-time state change to transfer the ATOM from an attacker-linked address to a recovery multisig, then normal transactions resumed. A Sept. 24 Hub update said the binary was scoped only to that source account and did not change other user balances or delegations.
Cosmos Labs said validators received the source and destination addresses, the list of six signers and the proposed scope before the binary was built and distributed. Validators representing more than 67% of Hub voting power confirmed installation before the Sept. 23 restart. Blocks resumed at 12:00 UTC, and the transfer took effect at about 12:06 UTC. The maintainers said the binary was tested against a fork of mainnet state and distributed with a checksum. Its source diff was withheld because publication would expose security fixes in the underlying v28.2.0 release still under a coordinated disclosure embargo; Cosmos Labs said it expected to publish the diff after the embargo lifts.
At 15:40 UTC on Sept. 26, a Hub balance query showed the recovery address held 1,227,121.374688 ATOM. The signers holding the funds said they will require a Hub governance proposal to pass before releasing the tokens to affected users and protocols. Cosmos Labs added that the Neutron response team is preparing the evidence and distribution plan to support a return.
Why this matters
The operation shows Cosmos Hub’s ability to coordinate a rapid, targeted rollback of attacker funds without a broad chain reorg. Equally important, it separates emergency containment (validator action) from compensation (on-chain governance), aiming to avoid ad hoc distribution decisions by a small group. The trade-off is clear: validator power can protect applications in crisis, but it also sets a precedent for state changes, making process design and transparency critical.
▲ 1.43%
What to watch next
- The text and scope of the Hub governance proposal, including eligibility and distribution criteria
- Publication of the withheld source diff once the embargo lifts
- Any movement from the recovery address or updates from the six signers
- Neutron’s evidence package and issuer-level flow detail supporting distributions
This content is for informational purposes only and does not constitute financial advice.
🧠 HafidWatch Take
The Hub’s rapid, validator-led seizure shows Cosmos can execute social recovery at speed, but pushes the thornier decision—who gets made whole—into governance. The split is sensible: validators stop outflows; the community decides distribution. The key risk now is process design. Clear eligibility rules and issuer-level flow data from Neutron will determine whether this becomes a clean precedent or a politicized one. Watch the governance text, the signers’ stated release conditions, and whether the final diff is published post-embargo. A delay or scope creep would raise questions about repeatability and neutrality.
Daily crypto intelligence. Before the market opens.
Including the Divergence Index — the sentiment gap no other newsletter tracks. Free, every morning at 7:30am ET.
✓ Free forever · ✓ No spam · ✓ 50+ sources monitored