Cosmos Hub restart moves 1.23 million ATOM from Neutron exploiter's wallet without owner's signature
Key Takeaways
- •Cosmos Hub validators withdrew 1,227,121 ATOM, valued at roughly $2.1 million, from the Neutron exploiter's wallet via a state-level transfer during Wednesday's restart, without needing the wallet owner's signature.
- •The withdrawn tokens now sit at cosmos1z8pq5c, an address that no key has ever signed for, and neither validators nor the Cosmos Hub team has named anyone as controlling it.
- •The Neutron exploit originated from proposal 9, which passed with 81.88% approval after one account spent 20,199 USDC to buy and stake 31.6 million tokens less than 12 minutes before voting concluded.
- •The attacker gained admin control of 10 contracts across Astroport and Drop — leaving only the Astroport Treasury untouched — and drained them within 24 minutes, exploiting a gap between Neutron's roughly $113,000 bonded stake and about $9.4 million held in the targeted contracts.
- •A 168,990-ATOM THORChain refund that arrived after the restart stayed under the owner's control and was bridged to Osmosis, while Neutron remains halted and about $1.96 million of the stolen funds were on live chains as of Tuesday.
Cosmos Hub validators have withdrawn 1,227,121 ATOM — worth approximately $2.1 million — from the wallet of the Neutron exploiter, executing the move as the network restarted on Wednesday (Cosmos Hub on X).
The chain halted at block 33,086,740 and resumed at block 33,086,741. Upon resuming, validators carried out the transfer directly at the state level, without requiring a signature from the wallet's owner. The method is the broader context: a coordinated validator upgrade can move balances without any signature from the holder, so custody of assets on the chain rests on validator consensus as well as on key control.
Tokens moved to an address no key has ever signed for
The ATOM now sits at cosmos1z8pq5c, an address that no key has ever signed for. Neither validators nor the Cosmos Hub team has named anyone as controlling it.
Validators froze the hub on Tuesday at 11:18 UTC and unfroze it on Wednesday at 12:00 UTC. A day earlier, the Hub team had flagged an upcoming network change targeting the ATOM the exploiter had parked on its chain. According to the team, its own chain was never compromised, and only Neutron assets were affected.
A 168,990-token refund slipped out to Osmosis after the restart
At 12:07 UTC on Wednesday, a THORChain vault sent 168,990 ATOM to the wallet from an order that never fully executed. A subsequent 500,000-ATOM send to Osmosis at 12:09 UTC bounced, as the wallet held about a third of that amount. The sequence marks the edge of the intervention: the state-level withdrawal captured what the wallet held at the upgrade height, while funds arriving after resumption remained under the owner's control.
On-chain records indicate that the owner then bridged the refunded 168,990 ATOM to the Osmosis address of the same key at 17:54 UTC.
A $20,199 vote bought admin control of 10 Astroport and Drop contracts
The exploit traces back to Neutron proposal 9, filed Sept. 19 on the expedited track. The proposal spent three days in voting and required 67% approval to pass, and claimed to be research into allowing AI agents to run a test network.
Its payload contained 11 MsgUpdateAdmin messages, each naming the proposer's own key as admin. On-chain data shows the proposal passed with 81.88% yes votes when the tally was run at 02:24 UTC on Sept. 22.
On-chain analyst Rarma found that most of those yes votes were bought at the last minute. One account voted yes while holding only about 100 NTRN, then spent 20,199 USDC to buy 31.6 million additional tokens and staked them less than 12 minutes before voting ended. The purchase — made mostly from Astroport pools the attacker drained soon afterward — cost about $0.00064 per token.
Rarma estimated Neutron's entire bonded stake at around $113,000, guarding contracts that held about $9.4 million — the gap between the value securing the vote and the value the vote could reach is the arithmetic at the core of the exploit. Eight of the targeted contracts belonged to Astroport and two to Drop. Starting at 02:38 UTC, the attacker swapped custom code into 10 of the 11 contracts, leaving only the Astroport Treasury untouched, and drained the rest within 24 minutes.
As of Tuesday, Rarma's figures put only about $1.96 million of the take on live chains, with the remainder immobilized. Neutron produced its last block at 07:43 UTC on Tuesday, and the chain remains halted.
The move follows other recent interventions across the Cosmos ecosystem. According to Cryptopolitan, Cronos validators rolled their chain back after an estimated $75 million exploit at Tectonic in August. Also that month, a bug in an EVM component used by multiple Cosmos chains forced TAC to freeze its network. Taken together, the incidents show chains opting for coordinated halts, rollbacks, or state-level transfers when exploits or bugs put assets at risk. The Cosmos Hub action differs from Cronos's rollback in one respect: the restart resumed at the halted height, with block 33,086,741 following 33,086,740 directly, leaving the chain's earlier history intact. The remaining questions are observable on-chain: whether and how Neutron restarts, and whether the immobilized funds or the recovered ATOM move next.
