The Cosmos Hub resumed producing blocks after a 24-hour, 48-minute halt, and the restart moved 1.23 million ATOM out of the wallet of an attacker who took over 11 Neutron contracts through a governance vote. Validators plan to hold the stolen ATOM in a multisig until Neutron comes back online.
A 24-Hour Halt, Then a Coordinated Transfer
The Cosmos Hub resumed producing blocks at 8:06 a.m. ET on Wednesday, and the restart moved 1.23 million ATOM out of the attacker's wallet. Validators coordinated the halt and the restart among themselves.
Block results for block 33,086,741 show 1,227,121.374688 ATOM moving between two addresses, recorded in the block's finalization events rather than in any transaction. That block carried a timestamp of 11:18:23 UTC on Sept. 22, and the next block landed 24 hours and 48 minutes later. The Cosmos Hub said the network "has been successfully restarted by validators on schedule" and that operations are normal.
Twelve Minutes Of Voting Power
The attacker used an expedited Neutron governance proposal, titled "AIATO: AI Agent Takeover," to reassign admin rights on 11 contracts to an address it controlled. The tally recorded 37.3 million NTRN in favor against 8.09 million opposed, clearing the 67% expedited threshold with 82% support.
A second address bought NTRN across five transactions for a combined 20,199 USDC, then delegated 31.6 million NTRN just 11 minutes and 39 seconds before voting closed. Cosmos SDK tallies each vote using the voter's stake at the end of the voting period, so the late staking move counted in full.
Contracts Drained Within Minutes
Ten of the 11 contracts were migrated to malicious code and drained, including six Astroport pairs, Astroport's staking contract, two Drop contracts and an investor vesting contract. Spaydh, who relayed information between teams during the incident, put the impact at roughly $4.4 million, primarily in ATOM, with the expected net loss closer to $2.2 million once Hub-held ATOM is excluded.
Astroport's tracked total value locked fell to $3.61 million on Wednesday from $4.54 million the day before, with its Neutron liquidity deployment now reading zero. Neutron itself has not produced a block since the halt, a gap of more than 35 hours, though a new binary built by CryptoCrew is in review to revert the contracts and transfer the attacker's funds to a validator multisig.
ATOM Holds Its Range
ATOM fell 4.9% over 24 hours and traded up 14% over seven days, for a market value of $908 million. It traded through the halt without breaking its weekly range, with its low for the period coming Wednesday afternoon, hours after the Hub restarted.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
