Cosmos Hub validators intercepted 1,227,121.37 stolen ATOM after an attacker drained funds from Neutron on Sept. 22 and routed part of the haul through the Hub. The tokens now sit in a six-signer recovery multisig, but the signers say they won't release them until a Hub governance proposal authorizes a distribution plan.
Hub validators secured 1,227,121.37 ATOM of the roughly 1.73 million stolen ATOM that an attacker moved from Neutron to the Cosmos Hub during the Sept. 22 governance attack. The six-signer multisig now holding the funds, however, says it needs a passed Hub proposal before it will release anything to affected users and protocols.
How validators secured the ATOM
The attack began on Neutron on Sept. 22, when a governance proposal gave the attacker administrative control over contracts used by Astroport and other protocols. The attacker then moved part of the stolen assets to other networks, including the ATOM that reached the Cosmos Hub. As the attacker swapped and bridged the tokens, Hub validators halted the chain at height 33,086,740 and restarted on a patched build, v28.3.0. At the first height after the halt, the patch executed a one-time state change that moved the ATOM from the attacker-linked address to a recovery multisig before ordinary transactions resumed. Validators representing more than 67% of Hub voting power had confirmed installation before the Sept. 23 restart, and the transfer took effect at about 12:06 UTC.
Custody does not settle who gets paid
Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu are the six validators named as multisig signers, and any four of their signatures meet the wallet's technical threshold for a transaction. The signers say they will still wait for a public Hub mandate before choosing where the funds go, and Cosmos Labs says it holds no key to the multisig wallet itself. A Hub governance proposal list checked at 15:40 UTC on Sept. 26 showed no passed mandate for the recovery multisig; a separate proposal in voting at the time, "ATOM Refund & Justice Bounty," sought a different refund and bounty and did not authorize this multisig's distribution.
What the patch could not capture
The Hub transfer only covered ATOM sitting in the one attacker-linked address at the moment of the halt. Another 168,990.9 ATOM reached the same attacker address just after the restart, once the one-time transfer had already executed, and that batch was moved to Osmosis and sold. Cosmos Labs said roughly 500,000 ATOM had already been swapped through THORChain before the halt, and other stolen assets reached networks beyond the Hub. The Neutron-side recovery plan must still establish who is owed what before a Hub proposal can give the six signers the mandate they say they require.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
