Cosmos Hub Restarts After Near-Day Halt, Sweeps $2.2M in ATOM; 169,000 ATOM Still Slips Out

Cosmos Hub has restarted after a network halt that lasted nearly a day, resuming block production on Sept. 23. The chain came back online at block 33,086,741. As part of the restart, Cosmos Hub executed an upgrade that transferred 1,227,121.37 ATOM—worth about $2.2 million—from an attacker-linked address into a designated recovery address before normal activity resumed. Cosmos Hub said the Hub itself was not exploited, adding the halt was intended to secure assets bridged from Neutron. Those secured assets were moved into a community validator multisig. Former Neutron contributor Spaydh said the incident began on Neutron, where an attacker accumulated enough NTRN voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts. He said the affected contracts included infrastructure used by Astroport and Drop, and were migrated to malicious code that enabled asset withdrawals. Spaydh estimated the initial impact at roughly $4.4 million, including about $3 million in ATOM, $1.2 million in USDC, around $100,000 in DYDX, and smaller amounts of wstETH and WETH. An earlier estimate had put losses at roughly $9.3 million. He said Neutron rate limits and the subsequent halt prevented some assets from leaving the network, protecting more than $1.6 million in USDC as well as significant amounts of NTRN and ASTRO. Spaydh said roughly 70% of the stolen ATOM was still on Cosmos Hub when validators stopped block production, leaving about $2.15 million in ATOM within reach of the recovery operation. He added that a later THORChain refund reached the attacker after the recovery transaction had already executed. Crypto analyst Rarma said 168,990.9 ATOM reached the attacker-linked address seven blocks after the restart. The tokens remained there for nearly six hours before being sent to Osmosis, where they were sold in batches for about 266,841 USDC. Much of the proceeds was later converted into Ethereum. Rarma also said an earlier attempt to transfer 500,000 ATOM failed due to insufficient funds, but indicated the attacker-linked address could still submit an IBC transfer after the restart. Cosmos Hub has not publicly explained why the later transfer succeeded or whether additional restrictions were intended for funds arriving at the address after the initial sweep. Cosmos Hub said the recovered ATOM remains under community control and that Hub validators, Neutron participants, and affected protocols are coordinating the return of funds. Spaydh said contributors have prepared a new binary to restore affected contracts to their previous code and administrators, tighten governance controls, and move remaining attacker-controlled assets into a validator multisig. The asset-return process is still being finalized. Recovered funds are expected to be returned to the original contracts and users after Neutron resumes block production. Spaydh said Neutron was targeting a restart within roughly 24 hours, with asset returns expected to begin afterward. The project plans to publish a full postmortem once the chain is back online. Cosmos Hub said it will share further details on the secured ATOM in a separate forum update.