Cosmos has intercepted 1.23 million stolen ATOM tokens, but refunds now await a governance vote.

During the September 22 governance attack that started on Neutron, an attacker routed roughly 1.73 million stolen ATOM to the Cosmos Hub. Hub validators used an emergency software patch to secure 1,227,121.37 ATOM from that flow, but the six signers of the recovery multisig say affected users and protocols cannot receive the funds until a separate Cosmos Hub governance proposal passes. The September 25 account from Cosmos Labs, published first by CryptoSlate, drew a line between the validators' emergency action to prevent further outflows and the later decision over who should receive the money. A Hub balance query at 15:40 UTC on September 26 showed the recovery address holding 1,227,121.374688 ATOM. The tokens remained in custody while the Neutron response team continued preparing evidence and a distribution plan to support a return.

How the Hub intercepted part of the stolen balance

The attack began on Neutron on September 22, when a governance proposal gave the attacker administrative control over contracts used by Astroport and other protocols, according to the Hub maintainers. Some of the stolen assets were moved to other networks, including roughly 1.73 million ATOM sent to the Cosmos Hub. The Hub was not the compromised network; it was the place where part of the stolen balance could still be caught.

As the attacker swapped and bridged ATOM, Hub validators halted the chain at height 33,086,740. They then agreed to restart on a patched version of the Gaia software, v28.3.0. Immediately after the halt, the patch executed a one-time state change that moved 1,227,121.37 ATOM from the attacker-linked Hub address to the recovery multisig, before normal transactions resumed. A September 24 Hub update said the binary was scoped to that one source account and did not change other user balances or delegations.

Cosmos Labs said the process was a coordinated validator update, not an on-chain vote authorizing compensation. Validators received written source and destination addresses, the list of six signers and the proposed scope before the binary was built and distributed. Validators representing more than 67% of Hub voting power had confirmed installation before the September 23 restart. Blocks resumed at 12:00 UTC, and the transfer took effect at about 12:06 UTC.

Maintainers said the binary was checked against a fork of mainnet state and shipped with a checksum. They withheld the source diff initially because making it public would reveal fixes in the underlying v28.2.0 release, which remained under a coordinated disclosure embargo. Cosmos Labs said the diff was expected to be published after the embargo lifted, but described that as the September 25 timetable rather than confirmation that it had already been released.

Custody does not settle who should be paid

Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu are the six validators named as multisig signers. Any four signatures meet the wallet's technical threshold for a transaction. The signers have stated a separate condition for using that capability: a passed Cosmos Hub signaling proposal must authorize a legitimate transfer. Cosmos Labs said it has no key to the wallet.

The episode shows two separate kinds of control. During the halt, a validator supermajority agreed to change Hub state so the attacker could not move the balance already sitting there. The custody signers hold the stolen ATOM, yet say they will not decide a destination until a public governance mandate exists. The emergency patch did not identify every valid claimant or approve a distribution schedule.

The proposed route starts on Neutron's side. Cosmos Labs said Neutron had returned to service with mitigations by September 25, and contributors plus affected protocols, including Astroport and Drop, were assembling evidence of what was taken and where recovered assets should go. The response team was expected to bring or support a Hub proposal the following week. The Hub account said it was up to Neutron governance to decide whether that network also votes.

A Hub governance proposal list checked at 15:40 UTC on September 26 showed no passed mandate for the recovery multisig among visible post-incident entries. Proposal 1057, the latest entry, concerned recovering a Realio IBC light client. Proposal 1056, titled “ATOM Refund & Justice Bounty,” was still in voting and sought a different refund and bounty; it did not authorize the Neutron response team's distribution from this multisig. As of that check, the governance requirement had not yet been satisfied.

What the emergency patch could not catch

The transfer captured only the ATOM already sitting in one attacker-linked address when the halt occurred; it did not undo the wider Neutron attack. Cosmos Labs said roughly 500,000 ATOM had already been swapped through THORChain before the halt, and other stolen assets had moved beyond the Hub. The account did not set the final size of each affected account's claim and did not promise full reimbursement.

Another 168,990.9 ATOM illustrates the patch's time limit. A pending THORChain refund arrived at the attacker address just after the restart, after the one-time transfer had already executed. Cosmos Labs said validators knew the refund might arrive, but changing the tested binary to capture it would have required different code and a longer halt. The returned ATOM was moved to Osmosis and sold. It was a later arrival at the attacker address, separate from the balance already transferred to the multisig. A rule applied once at the restart could not automatically sweep a later deposit.

The source also listed related readings: “Neutron DAO passes a new proposal, and $9.3 million in crypto disappears”; “Cosmos restarted to seize $2.2 million in stolen ATOM, but 169,000 tokens still escaped”; and “Stopping a blockchain doesn't always recover stolen funds – What actually happened when 3 networks pulled the plug.” Those references reinforce the same point: an emergency state change can freeze assets already present, but it does not automatically resolve claims or stop funds that move later.

What comes next for the recovered ATOM

The Neutron-side recovery plan must still establish who is owed what and where the funds should go. A Hub proposal backed by that plan would then give the six signers the public mandate they say they require. Until those steps occur, the secured ATOM remains available for recovery, with its recipients unresolved.

SEO Description: Cosmos Hub validators secured 1,227,121.37 ATOM from the September 22 Neutron attack, but refunds await governance.

Tags: ATOM, Cosmos Hub, Neutron, Governance, Multisig

Featured image: Abstract security vault, connected network nodes and a ballot, dark blue and cyan, without text or logos.