Cosmos Hub recovers 1.23M ATOM from theft, governance vote required for refund
In brief
- Cosmos Hub validators halted the chain September 23 and deployed an emergency patch securing 1,227,121 ATOM stolen in a Neutron governance attack.
- Six validators (Nansen, Keplr, Enigma, Silknodes, Kiln, Polkachu) control the recovered ATOM in a multisig wallet requiring four signatures.
- Custody signers will not release funds until a Cosmos Hub governance proposal authorizes transfer to affected users and protocols.
The attack and immediate response
An attacker moved roughly 1.73 million stolen ATOM from Neutron to the Cosmos Hub during the September 22 governance attack. As the attacker swapped and bridged ATOM, Hub validators halted their chain at height 33,086,740. The attack began on Neutron when a governance proposal gave the attacker administrative control over contracts used by Astroport and other protocols.
Validators then agreed to restart on a patched version of the Gaia software, v28.3.0. Validators representing more than 67% of Hub voting power had confirmed installation before the Sept. 23 restart. Blocks resumed at 12:00 UTC on September 23. The patch made a one-time state change that transferred 1,227,121.37 ATOM from the attacker-linked Hub address to a recovery multisig, taking effect at approximately 12:06 UTC.
Custody and governance conditions
Six validators — Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu — hold the recovered ATOM as multisig signers. Any four signatures meet the wallet's technical threshold for a transaction. But those signers have stated a separate condition: a passed Cosmos Hub signaling proposal must authorize a legitimate transfer before they release the funds to affected users and protocols.
"the six signers holding it say a separate Hub governance proposal must pass before they release the funds to affected users and protocols."
This is a coordinated validator update, not an on-chain vote authorizing compensation. Cosmos Labs says it has no key to the wallet. The emergency patch was distributed only after validators received the written source and destination addresses, the list of six signers and the proposed scope.
Next steps
Contributors and affected protocols, including Astroport and Drop, were preparing evidence of what was taken and where recovered assets should go. The Neutron response team was expected to bring or back a Hub proposal in the following week after September 25. Neutron itself had relaunched with mitigations by September 25.
