Cosmos Hub restarts and pulls $2.1M ATOM after Neutron governance attack
By Crypto Wire
September 23, 2026
The Cosmos Hub resumed block production on Wednesday morning after validators halted the network for nearly 25 hours, and the first post-restart block moved 1,227,121 ATOM—about $2.1 million—out of a wallet holding proceeds from a Neutron governance attack, according to Unchained’s September 23 report. The transfer appears in that block’s events without a signature from the wallet’s owner and sent the tokens to a newly created address. Just over a minute later, a THORChain vault returned 168,991 ATOM—the unfilled remainder of a 200,000-ATOM swap submitted before the halt—worth about $294,000. Two minutes after that, an attempt to send 500,000 ATOM to Osmosis failed for insufficient funds.
The Hub pause was a containment move, not a claim that Cosmos Hub software itself was exploited. In its restart notice, the Cosmos Hub account said the Hub “was not exploited and no funds were impacted apart from the assets moved from Neutron,” and that validators had prepared a network update “intended to address the stolen ATOM currently held on the Hub.” Who controls the receiving address after the unsigned move was not named in those posts. For Rug Room desks, the sequence matters: Neutron drained first; Hub validators froze the chain to pin attacker ATOM; restart then executed the isolation transfer before normal routing resumed.
The underlying hit was Neutron Proposal 9, titled “AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration,” which ran the expedited three-day track and closed at about 10:24 p.m. ET Monday with roughly 82% of votes cast in favor. The written summary framed an experiment in which autonomous AI agents would take operational control of a live testnet. The executable payload carried 11 MsgUpdateAdmin messages that handed admin control of Neutron contracts to the proposer’s own address—overriding the target protocols’ own governance on contracts the chain did not own, on-chain analysts said.
Ten of those contracts belonged to the DEX Astroport and the liquid-staking protocol Drop, per an on-chain reconstruction published Tuesday by X user Rarma and carried by Unchained and Cryptonomist. The account carrying most of the yes vote bought about 31.6 million NTRN with 20,199 USDC and staked it less than 12 minutes before voting closed—turning a roughly twenty-thousand-dollar token purchase into decisive control. The attacker then swapped the code of 10 of the 11 contracts and emptied them in less than half an hour, taking tokens Rarma valued at about $9.4 million. About $1.96 million of that sat on chains that were still running at the time of the write-up; Protos separately split Astroport and Drop drains near $4.9 million and $4.4 million respectively and noted only about 20% of the haul had been extracted while the rest sat on halted networks.
Neutron itself has not produced a block since about 3:43 a.m. ET Tuesday, according to public nodes cited by Unchained. A former Neutron contributor said the chain “was halted to prevent further harm.” Astroport told users on X to “withdraw your liquidity from Astroport on all chains until further notice.” Neutron had already entered a long-term maintenance phase in June—context that does not excuse the governance override but explains why thin security budgets on a chain still guarding multi-million-dollar third-party contracts is a standing Rug Room risk.
GoPlus Security’s breakdown, as summarized by Cryptonomist, framed the episode as a mismatch between how little it costs to swing expedited governance and how much value that governance can reassign. Early in the vote the attacker cast with only around 100 NTRN; the decisive 31.62 million NTRN buy landed about 11 minutes before tally. Within roughly 24 minutes of execution, funds were reportedly spread across Neutron, Cosmos Hub, Noble, Axelar, dYdX, Osmosis, and Ethereum addresses. Protos put the attacker’s Ethereum address near $1.8 million with a further THORChain-linked balance later refunded toward Hub isolation—consistent with the 168,991 ATOM return Unchained timed just after restart.
Why NFT and crypto collectors still open this file: Cosmic DeFi LP and liquid-staking contracts sit beside the same Hub rails that settle IBC-bridged NFT and collectible flows. A governance MsgUpdateAdmin override that bypasses protocol-owned admin keys is a different failure mode from a simple private-key drain—and the Hub’s 25-hour halt shows how far validators will go to freeze attacker ATOM once it lands on the Hub. Attribute cleanly: Unchained for the restart, unsigned 1,227,121 ATOM move, THORChain return, and Proposal 9 vote math; Rarma via Unchained/Cryptonomist for the $9.4 million contract drain and last-minute NTRN buy; Cosmos Hub account for the “not exploited” Hub statement; Astroport for the all-chains LP withdraw advisory. Do not invent that Hub consensus code was breached, that Neutron has restarted, or that recovered ATOM has already been returned to end users.
What to watch next for Orange County desks: whether Neutron publishes a restart plan and which Astroport/Drop contracts stay frozen; whether Hub governance discloses custody of the new address holding the isolated 1.23 million ATOM; whether residual Ethereum and bridged balances move further; and whether other Cosmos appchains tighten expedited-vote deposit and late-delegation rules after a $20,199 swing bought control of roughly $9.4 million in third-party TVL. Until Neutron resumes blocks, treat Astroport’s withdraw-everywhere notice as the live user action item—not a rumor that Hub restart alone restored those LPs.
Bottom line: On September 23, Cosmos Hub restarted after a ~25-hour halt and moved 1,227,121 ATOM (~$2.1 million) from an attacker wallet tied to Neutron’s Proposal 9 “AIATO” governance override that drained about $9.4 million from Astroport and Drop—while Neutron remains halted and Astroport still tells users to pull LP on all chains.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
