Cosmos Hub Secures 1.227M ATOM After Neutron Governance Exploit; Assets Moved to 4-of-6 Multisig

Cosmos Labs said Neutron was hit by a governance attack on Sept. 22 that led to liquidity being stolen from protocols including Astroport. The attacker later sent about 1.73 million ATOM to the Cosmos Hub. Cosmos Labs emphasized the Hub itself was not breached and user funds were not affected. To stop further movement of the stolen tokens, Hub validators paused the network for roughly 24.5 hours, then resumed block production on Sept. 23 after deploying the patched Gaia v28.3.0. During the halt, 1.227 million ATOM remained in the attacker's Hub address. Once the chain restarted, that amount was transferred in a single transaction to a 4/6 multisig address controlled by Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Cosmos Labs said roughly 500,000 ATOM had previously been swapped into ETH via THORChain and is not recoverable. After the restart, an additional 169,000 ATOM arrived in the attacker's address due to a THORChain refund, was then moved to Osmosis, and sold. The multisig currently holds about 1.227 million ATOM. Cosmos Labs said the funds can only be returned through approval of a Cosmos Hub governance proposal and will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposal next week.