Cosmos Hub restarted after a nearly day-long halt, moving 1.23 million ATOM linked to a governance exploit on Neutron.
Validators resumed block production on Sept. 23 after stopping the network a day earlier, with the first block after the restart moving 1,227,121.37 ATOM, worth about $2.2 million, from an attacker-linked address.
The intervention followed the movement of funds stolen from Neutron onto Cosmos Hub, extending the fallout from an attack that began on a separate blockchain in the Cosmos ecosystem. Cosmos Hub said its network was not exploited and that the halt was intended to secure assets bridged from Neutron before they could move further.
Block production resumed at block 33,086,741, with the upgrade transferring the attacker-linked balance into a recovery address before ordinary activity continued. Cosmos Hub later said the secured assets had been placed in a community validator multisig while participants coordinated their return.
Former Neutron contributor Spaydh said the attack began after an attacker accumulated enough NTRN voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts.
The affected contracts included infrastructure used by Astroport, Drop, and other protocols and were subsequently migrated to malicious code that allowed assets to be withdrawn.
Spaydh estimated the initial impact at roughly $4.4 million, comprising about $3 million in ATOM, $1.2 million in USDC, around $100,000 in DYDX and smaller amounts of wstETH and WETH. Notably, CryptoSlate previously reported that the losses amounted to roughly $9.3 million.
Neutron’s rate limits and subsequent halt prevented some of those assets from leaving the network. Spaydh said more than $1.6 million in USDC was protected, along with significant amounts of NTRN and ASTRO.
Roughly 70% of the stolen ATOM remained on Cosmos Hub when validators stopped block production, leaving about $2.15 million of ATOM within reach of the recovery operation.
Cosmos recovery leaves one gap as Neutron prepares restart
The first-block sweep secured most of the stranded ATOM, but a later refund from THORChain reached the attacker after the recovery transaction had already executed.
Crypto analyst Rarma said 168,990.9 ATOM arrived at the attacker-linked address seven blocks after the restart.
The tokens remained there for almost six hours before being transferred to Osmosis and sold in batches for about 266,841 USDC, with much of the proceeds subsequently converted into Ethereum.
The THORChain refund arrived after the sweep, leaving the newly returned ATOM outside the recovery transaction.
Rarma said an earlier attempt to transfer 500,000 ATOM was also included in a block and paid a fee before failing because the wallet lacked sufficient funds. He said the transaction showed the attacker-linked address could still submit an IBC transfer after the restart.
Cosmos Hub has not publicly explained why the later transfer proceeded or whether additional restrictions were intended for funds reaching the address after the initial sweep.
The bulk of the recovered ATOM remains under community control. Cosmos Hub said the funds captured during the restart came from the Neutron attack and are being held in a validator multisig while Hub validators, Neutron participants and affected protocols coordinate their return.
Meanwhile, attention is now shifting back to Neutron.
Spaydh said contributors have prepared a new binary that would restore affected contracts to their previous code and administrators, tighten governance controls, and move remaining attacker-controlled assets into a validator multisig.
The asset-return process is still being finalized, with recovered funds expected to be sent back to their original contracts and users after Neutron resumes block production.
Spaydh said Neutron was targeting a restart within roughly 24 hours and expected asset returns to begin afterward. The project also plans to publish a full post-mortem once the chain is back online.
Cosmos Hub said a separate forum update will follow with further details on the secured ATOM, leaving validators and affected protocols to reconcile the recovered balance against the portion that escaped after the restart.