Cosmos Hub Recovers 1.227 Million ATOM from Neutron Attack, Funds Temporarily Held in 4/6 Multisig Address

Cosmos Labs disclosed that on September 22, Neutron suffered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. Cosmos Hub itself was not attacked, and user funds were unaffected. To prevent the stolen ATOM from being transferred out further, Hub validators temporarily paused the network for approximately 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0. Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address, and upon network resumption, a one-time change transferred these funds to a 4/6 multisig address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Approximately 500,000 ATOM had previously been swapped into ETH via THORChain and cannot be recovered; an additional 169,000 ATOM entered the attacker's address after network resumption due to a THORChain refund and were transferred to Osmosis and sold. The multisig address currently holds approximately 1.227 million ATOM, which can only be returned upon authorization by a Cosmos Hub governance proposal, and these funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposal next week.