Cosmos Hub: 1.227 million ATOM recovered from Neutron attack case, funds temporarily held in 4/6 multisig address

BlockBeats news, September 26 — Cosmos Labs disclosed that on September 22, Neutron suffered a governance attack that led to the theft of liquidity from protocols including Astroport, and approximately 1.73 million ATOM was subsequently transferred by the attacker to Cosmos Hub. Cosmos Hub itself was not attacked, and user funds were unaffected. To prevent the stolen ATOM from being further transferred out, Hub validators temporarily halted the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.

Cosmos Labs stated that during the halt, 1.227 million ATOM remained in the attacker's Hub address, and when the network resumed, it was transferred via a one-time change to a 4/6 multisig address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu.

Previously, about 500,000 ATOM had already been swapped into ETH via THORChain and cannot be recovered; another 169,000 ATOM entered the attacker's address after the network resumed due to a THORChain refund and was transferred to Osmosis and sold.

The multisig address currently holds about 1.227 million ATOM, which can only be returned after authorization by a Cosmos Hub governance proposal, and the relevant funds will not be staked, lent, or traded. The Neutron team is expected to submit a recovery plan and related governance proposal next week.