Overview of the Incident
Validators responsible for the Cosmos Hub have successfully safeguarded approximately 1.23 million ATOM tokens following a governance attack on the Neutron protocol. The network was temporarily suspended for around 24.5 hours while steps were taken to transfer the tokens into a recovery wallet designated for security purposes. In a statement released on September 25, Cosmos Labs clarified that the Hub itself was not directly compromised and that user funds within the Hub were not affected by this incident.
Details of the Attack
The tokens in question were initially siphoned off during a malicious governance proposal which effectively allowed the attacker to manipulate contracts employed by other protocols, such as Astroport. As validators halted the Hub’s operation, the attacker still controlled 1,227,121 ATOM in their address. The network was successfully restarted on September 23, implementing the Gaia v28.3.0 software update. This update facilitated the movement of the hijacked funds to a wallet overseen by six designated community validators, who are required to approve any subsequent withdrawals.
These funds will be retained while the Neutron recovery team develops a formal plan for their distribution. Cosmos Labs emphasized that the signers of the recovery wallet are unable to return the funds unless authorized by a governance proposal passed within the Cosmos Hub community.
Response and Recovery Efforts
Following the governance breach that transpired on September 22, the attacker started distributing the stolen assets across various blockchain platforms, with some of the ATOM being traded through THORChain. Notably, around 1.73 million ATOM made its way back to the Hub, where the potential for further transfers existed even post the suspension of Neutron’s block production.
Warning signals from contributors and users were sent to Hub validators and the Cosmos Labs team around 09:50 UTC, prompting validators, holding a significant share of the Hub’s voting power, to bring down the network at block 33,086,740 by approximately 11:18 UTC.
During this downtime, the teams worked on a swift software adjustment crafted by Cosmos Labs in response to validators’ requests. This plan identified the attacker’s address and designated destination wallet while clarifying the roles of the six proposed signers involved in the recovery process.
By the time the network resumed operations at noon on September 23, a considerable majority—over two-thirds—of validators had adopted the new software version. The transition of the recovered ATOM commenced around six minutes post-restart, with 174 out of 180 validators operational by day’s end, including prominent exchanges such as Coinbase and Kraken, which aided in the coordinated recovery efforts.
Challenges and Future Steps
It is important to note that the secured amount reflects only the ATOM still linked to the attacker’s Hub account at the precise time of suspension. Approximately 500,000 ATOM had reportedly been swapped for Ethereum prior to the halt, rendering them irretrievable through the Hub’s recovery protocols. Additionally, a separate transaction involving THORChain returned a further 168,990.9 ATOM to the attacker right after the Hub resumed block production, which the attacker subsequently transferred to Osmosis for liquidation.
The Cosmos Labs report also detailed that numerous stolen assets have traversed various networks, including dYdX, Noble, and EVM chains, along with those remaining on Neutron. Recovery teams across these platforms are presently organizing their own measures to address the fallout from the breach.
In August, a different security incident had already illustrated vulnerabilities within other Cosmos networks, where a flaw in the Cosmos EVM was exploited to convert stolen tokens into assets valued at around $5.72 million across multiple chains. However, the current incident specifically pertains to a governance attack on Neutron rather than this EVM exploit.
Commitment to Security
The six validators who hold the recovered ATOM have committed to abstaining from staking, trading, or lending the funds until proper governance processes allow for a resolution. A forthcoming governance proposal by the Neutron recovery team, expected next week, will provide a path forward for fund distribution based on community decisions. Historical governance actions within the Cosmos Hub highlight a precedent for stakeholder involvement in crucial decisions regarding the token’s management, including previous proposals related to asset conversions.
Thus, ATOM holders will play a key role moving forward, as the plan to return the secured tokens develops, with Cosmos Labs actively communicating with over 30 exchanges regarding the fraudulent addresses involved.
