Neutron DAO proposal triggers $9.3M losses at Astroport and Drop
In brief
- Neutron DAO passed proposal #9 on September 22 granting 11 admin permissions via AIATO governance.
- SlowMist recorded $9.3M combined losses: $4.9M at Astroport, $4.4M at Drop.
- Network halts stranded most assets; attacker extracted approximately one-fifth of total losses.
Proposal details and governance authority
Neutron's governance documentation describes the DAO as the network's highest governing authority. The proposal, titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration," contained 11 "Update Admin" actions that allowed the network's governance process to change control of a contract's administrator. This mechanism is standard in decentralized governance but carries significant risk if misused.
Incident scope and recovery status
SlowMist recorded estimated losses of $4.9 million at Astroport and $4.4 million at Drop on the same day the proposal passed. The combined estimate of $9.3 million reflects the reported incidents across both protocols.
Protos reported on September 23 that network halts stranded most of the initially affected assets. However, the attacker had extracted around one-fifth of affected assets at the time of that report. The ultimate amount recovered remains unclear, and the incident illustrates how governance mechanisms can expose protocols to rapid asset extraction when administrative controls shift unexpectedly.
What this means for governance
The incident raises questions about how DAO proposals are vetted before voting. While Neutron's governance is designed to give the community control, the speed and scale of the losses suggest that risk assessment around administrative transfers may need tighter review. Network halts proved effective at containing further damage, but they cannot reverse transfers already executed.
