Cosmos Hub halts, moves $2.1M ATOM after Neutron attack
4.5 Security Cosmos Hub halted for 24+ hours after a $9.5M Neutron attack. Validators froze and later moved $2.1M in stolen ATOM from the attacker’s wallet after the network restart.
Cosmos Hub experienced a halt in block production for over 24 hours following a governance attack on Neutron, a chain within the Cosmos ecosystem. The attacker exploited the system by passing a malicious proposal, "AI Agent Takeover," after acquiring $20,199 worth of NTRN tokens. This allowed them to gain control over Neutron-based applications, including Astroport and Drop, and drain a total of $9.5 million. Approximately 20% of the stolen assets were moved, while the remainder became trapped on networks that were subsequently halted. In response, Neutron was paused, and Cosmos Hub validators froze 1.2 million ATOM (valued at over $2.1 million) in the attacker's address. After the network restart, Cosmos Hub transferred 1,227,121 ATOM from the attacker's wallet to a new address without a signed transaction. Additionally, a THORChain vault returned 168,991 ATOM. This incident underscores vulnerabilities in governance mechanisms and marks the third major security scare for Cosmos in recent months.
