Cosmos Hub restart moves 1.23 million ATOM out of Neutron exploiter's wallet without its owner's signature

As the network restarted on Wednesday, Cosmos Hub validators withdrew 1,227,121 ATOM, worth around $2.1 million, from the wallet of the exploiter of Neutron.

The chain recorded the move as an event in block 33,086,741 and the owner of the wallet signed nothing.

A 168,990-token refund slipped out to Osmosis after the restart

Tokens are now sitting at cosmos1z8pq5c, which no key has ever signed for. No one has been named by validators or the Cosmos Hub team as controlling it.

The hub was frozen by validators Tuesday at 11:18 UTC, and was unfrozen Wednesday at 12:00 UTC. The Hub team had flagged an upcoming network change the day before, targeted at the ATOM the exploiter had parked on its chain.

The team says its own chain was never compromised, and only Neutron assets were affected.

At 12:07 UTC, a THORChain vault sent 168,990 ATOM to the wallet from an order that never fully executed. A 500,000-ATOM send to Osmosis followed at 12:09 UTC and bounced, as the wallet held about a third of that.

On-chain records indicate that the owner bridged the refunded 168,990 ATOM to the Osmosis address of the same key at 17:54 UTC.

A $20,199 vote bought admin control of 10 Astroport and Drop contracts

The money came from Neutron proposal 9, filed Sept. 19 on the expedited track, taking three days and requiring 67% to pass. The proposal claimed to be research into allowing AI agents to run a test network.

The payload contained 11 MsgUpdateAdmin messages, each specifying the proposer’s own key as admin. The on-chain data shows that 81.88% voted yes when the tally was run at 02:24 UTC on Sept. 22.

Most of those yes votes were bought at the last minute, on-chain analyst Rarma found. One account had voted yes while holding only about 100 NTRN, then spent 20,199 USDC on 31.6 million more and staked them less than 12 minutes before voting ended.

The purchase, which was mostly made from Astroport pools that the attacker drained soon after, cost about $0.00064 per token. Rarma estimated the entire bonded stake of Neutron at around $113,000, guarding contracts that held about $9.4 million.

Eight of the targeted contracts belonged to Astroport and two to Drop. The attacker swapped in custom code on 10 of the 11 from 02:38 UTC, leaving only the Astroport Treasury, and drained those in 24 minutes.

As of Tuesday, Rarma’s number put only about $1.96 million of the take on live chains, with the rest immobilized. Neutron’s last block was at 07:43 UTC on Tuesday and the chain is still halted.

According to Cryptopolitan, Cronos validators rolled their chain back following an estimated $75 million exploit at Tectonic in August. Also that month, a bug in an EVM component used by multiple Cosmos chains forced TAC to freeze its network.

The smartest crypto minds already read our newsletter. Want in? Join them.