Security
Cosmos Hub Validators Moved 1.2 Million ATOM Without a Governance Vote
An attacker used Neutron's own governance to take 11 contracts belonging to Astroport and Drop. The Cosmos Hub halted for nearly 25 hours, then restarted on a build with no public release tag, and the first block after the restart emptied the attacker's wallet into a new address. Nobody has said who controls it.
At 12:06 UTC on Wednesday the Cosmos Hub produced its first new block in almost 25 hours. The block before it, number 33,086,741, is where the story is. Its events record 1,227,121.374688 ATOM leaving the account cosmos1dd25c4ss…m96c4n for a newly created one, cosmos1z8pq5cn7…vph64. No transaction in the block moved the funds, and the owner of the sending account signed nothing. The transfer is written into the block's own finalize events, where chain software records changes it makes by itself. This desk pulled those events from two public nodes. As of Wednesday evening the receiving account still held exactly that amount and had never signed a transaction.
The sending account is the one that, two days earlier, took control of 11 contracts on Neutron through a governance vote. Unchained values the ATOM at about $2.1 million and Protos at about $2.2 million. Either way, it is the part of an estimated $9.4 million theft that the Hub's validators could reach.
A proposal that said it was a testnet experiment
Neutron is a Cosmos chain for CosmWasm smart contracts. Its proposal 9, read here directly from the chain's state, is titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration." The text describes itself as a "Live Testnet Experiment" in which autonomous AI agents would take operational control of a blockchain. It cites a real December 2024 paper, "Decentralized Governance of Autonomous AI Agents" by Chaffer and co-authors, and nothing suggests the paper's authors had any part in it. A few paragraphs further down, the same text says the agents will "fully participate in the mainnet DAO."
The payload told a simpler story. The proposal carried 11 MsgUpdateAdmin messages, each making the proposer the admin of one mainnet contract. By their on-chain labels, those contracts are six Astroport pairs, the Astroport Treasury, Astroport Staking, two Drop contracts (a dATOM converter and a staking withdrawal manager), and a vesting contract labelled for investors. In CosmWasm the admin is the party allowed to migrate a contract to new code. Chain-level governance can rewrite that admin for any contract on the chain, whatever multisig or DAO the protocol itself uses. Unchained reported that critics, including the commentator Rarma, objected that the vote overrode two protocols' own governance on contracts the chain did not own.
The first attempt, the cancellation, and the math
The proposer's transaction history adds a detail that has not been reported. The same address submitted proposal 7 on September 12, with three admin changes rather than eleven. It cancelled that proposal on September 19 at 02:10 UTC. Fourteen minutes later it submitted proposal 9 on Neutron's expedited track, which runs a 72-hour vote. The deposit on both was exactly 1,000,000 NTRN, the expedited minimum.
Neutron's governance parameters, also read from chain state, set a 30% quorum and a 67% yes threshold for expedited proposals. Voting closed at 02:24:49 UTC on September 22. The final tally was 37,313,263 NTRN yes, 8,088,351 no, 170,212 no-with-veto and a fraction of one NTRN abstaining: 81.9% yes. Turnout was about 33% of the 136.8 million NTRN bonded at Neutron's last block, three points above quorum.
Neutron proposal 9 final tally, millions of NTRN
GoPlus Security, as reported by The Cryptonomist, says the attacker bought 31.62 million NTRN for 20,199 USDC about eleven minutes before the tally. Unchained gives the same purchase and says it came less than twelve minutes before the close. The proposer's own address never cast a vote, so the buying and voting were done from somewhere else. This desk has not traced that address and is relying on GoPlus for the figure. If the figure is right, the arithmetic is stark. Without those tokens, the remaining 14 million NTRN of votes would have been roughly 13% of bonded stake, below quorum, and about 41% yes, far below 67%. At the price implied by that purchase, about $0.00064 per NTRN, the 1,000,000 NTRN deposit was worth roughly $640.
The chain's circumstances help explain the thin turnout. In March, Neutron announced a move to long-term maintenance. It said Hadron Labs would maintain the network until June 30, 2026, and that governance would switch from Neutron's custom model to the standard Cosmos one. The DAO's delegations to validators were to be withdrawn and burned between July and September. Proposal 9 closed eight days before that window ended.
Fourteen minutes, then two halts
The rest of the timeline is in the proposer's history. The address stored new contract code at 01:18 UTC on September 22, 66 minutes before the vote closed. Its first contract migration came at 02:38, fourteen minutes after the proposal passed. After that it alternated between migrations, withdraw_all calls and IBC transfers off the chain, contract by contract. Astroport publicly warned that its admin privileges may have been compromised and urged users to withdraw liquidity. Neutron's last block is 61,635,573, timestamped 07:43:55 UTC. As of this writing it has not produced another.
The Hub went down about three and a half hours later. Its last block before the halt, 33,086,740, is stamped 11:18:16 UTC on September 22. The @cosmoshub account said shortly afterwards that validators had halted the network to limit ATOM losses from the Neutron exploit, and that the community would decide what to do with the affected wallets before restarting. Its restart notice, quoted by Protos, said the Hub itself "was not exploited and no funds were impacted apart from the assets moved from Neutron."
One quirk of the record: block 33,086,741, the block that moved the ATOM, carries a timestamp of 11:18:23 UTC on September 22, a day before it was made. That is expected rather than suspicious. In CometBFT a block's time is derived from validators' signatures on the previous block, and those signatures predate the halt. The next block, 33,086,742, is stamped 12:06:23 UTC on September 23.
What has not been published
No on-chain vote authorized the move. The most recent Hub governance proposal is number 1055, submitted September 17, which scheduled an upgrade to Gaia v28.2.0 and passed. Since the restart, public Hub nodes report running Gaia v28.3.0. Because a Cosmos block needs signatures from two-thirds of voting power, at least two-thirds of the Hub's stake ran that build. Neither v28.3.0 nor v28.2.0 appears among the tags of the public cosmos/gaia repository, where the newest tag is v28.0.0. Proposal 1055 itself told operators to look for release details in "established communication channels." So the code that moved the funds is not yet published where the public can read it, and no statement this desk found says who controls the receiving account or how the ATOM will be returned.
The rest of the money is scattered. Protos reports roughly $5 million trapped on the halted Neutron chain and about $1.8 million at an attacker address on Ethereum. Unchained reports that THORChain returned 168,991 ATOM, about $294,000. Totals differ slightly between outlets, $9.4 million from GoPlus and $9.5 million from Protos, and this desk has not reconciled them.
The Take
The Hub's validators probably did the least bad thing available to them, and they did it quickly. But the precedent matters more than the sum. A chain that prides itself on on-chain governance just moved $2 million out of an account through coordinated software rather than a proposal, and the software is not public. That can be defended as an emergency measure only if what follows is done in the open: publish the v28.3.0 diff, name who holds the receiving key, and put the return of the funds to a Hub vote. Neutron's lesson is harsher and cheaper to state. A governance module that can rewrite the admin of every contract on a chain is only as safe as the price of a supermajority, and on a chain in maintenance mode with its DAO stake draining away, that price was about $20,000. Every Cosmos chain that keeps chain-level admin override switched on should look at its own bonded stake tonight and do the same arithmetic.