Cosmos Hub Halts for 24 Hours and Secures 1.23 Million ATOM: Inside the Emergency Patch That Froze a Hackers Wallet

Cosmos Hub validators have secured 1.23 million ATOM stolen in a Neutron governance attack, halting the network for roughly 24.5 hours and moving the tokens into a multi-signature recovery wallet — one of the most invasive but coordinated emergency responses a major proof-of-stake network has executed in years.

Cosmos Labs said in a Sept. 25 forum update that the Hub itself was not attacked and that Hub user funds were unaffected. The stolen ATOM originated on Neutron, where a malicious governance proposal handed an attacker control over contracts used by Astroport and other protocols. From there, about 1.73 million ATOM reached the Cosmos Hub, where the attacker could have kept moving funds even after Neutron stopped producing blocks.

## A 24-hour halt, planned in public

The timeline, as laid out by Cosmos Labs, shows how fast the response moved. After the Sept. 22 attack on Neutron, the attacker sent stolen assets to several chains and began swapping some ATOM through THORChain. Neutron contributors and community members alerted Hub validators and Cosmos Labs at roughly 09:50 UTC. Validators representing more than one-third of the Hub’s voting power then stopped their nodes, halting the network at block 33,086,740 by about 11:18 UTC.

During the pause, Cosmos Labs prepared a one-time software change at the validators’ request. The written plan identified the attacker’s address, the destination wallet, the six proposed signers and the single account the update would affect — and validators received the plan before the patched software was distributed.

Restarting required the opposite of halting: validators representing more than two-thirds of voting power had to install Gaia v28.3.0. Block production resumed at 12:00 UTC on Sept. 23, and the transfer of 1,227,121 ATOM took effect about six minutes later. By the end of that day, 174 of the Hub’s 180 validators were back online, with Coinbase and Kraken among the participating operators.

The recovery wallet requires four of six signers to approve any transaction. Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu hold the keys, and Cosmos Labs said the signers independently verified the wallet address with a test transaction before it was added to the update.

## What was recovered — and what was not

The secured balance covers only the ATOM still sitting in the attacker’s Hub address when the chain halted. Cosmos Labs said roughly 500,000 ATOM had already been swapped into ETH through THORChain before the halt and could not be recovered through the Hub update.

A second leak followed the restart. A separate THORChain transaction returned 168,990.9 ATOM to the attacker’s address shortly after block production resumed, and the attacker moved that balance to Osmosis and sold it. The patched update authorized a single transfer of the balance present at the halt height — it did not block later transactions from the attacker’s address or capture funds that arrived afterward.

The response also did not extend to other networks. Cosmos Labs identified stolen funds that had moved through dYdX, Noble, Osmosis, Axelar and EVM chains, as well as assets still on Neutron, with each network’s team coordinating its own recovery effort. The attacker’s addresses have been shared with more than 30 exchanges, bridges and custodians, several of which confirmed they blocked them.

Notably, this incident is separate from the August exploitation of a Cosmos EVM flaw across six chains, which netted attackers roughly 5.72 million USD in converted assets. The Neutron case was a governance attack, not a software vulnerability.

## The hard part is still ahead

The six signers have agreed not to stake, lend or trade the held ATOM, describing their role as executing an authorized return rather than deciding who gets compensated. That decision belongs to Cosmos Hub governance: the wallet cannot return the funds until a governance proposal passes.

The Neutron recovery team expects to submit a proposal in the coming week, once the destination and return process are set out, and Neutron’s maintainers plan to publish their own account of the attack early next week. The arrangement gives ATOM holders a direct vote on the final step — a precedent with weight, since Hub governance has previously ruled on contentious token matters, including rejecting an Osmosis plan to convert OSMO into ATOM.

The episode is likely to fuel a longer debate in proof-of-stake design. The Hub’s halt-and-patch response protected the majority of the stolen tokens, but it did so by freezing an entire network and surgically rewriting one account’s balance — capabilities that critics argue concentrate power in validator cartels and that defenders call a necessary emergency brake. With the funds secured and a governance vote pending, Cosmos has bought itself time to answer that question before the next attack.

Price snapshot at publication (CoinGecko, Sep. 26): BTC 84,160 USD; ETH 2,688.77 USD; SOL 121.33 USD.