Cosmos Hub Recovered 1227000 tokens ATOM, with the funds temporarily held in 4/6 multisig address
BIBIBI
AT A GLANCE
It was reported that 1227000 tokens of ATOM have been transferred to 4/6 multisig address and may be returned only after Cosmos Hub governance authorization.
Article
Cosmos Hub: recovered Neutron attacker 1227000 tokens ATOM, with the funds temporarily held in 4/6 multisig address
BlockBeats news,September 26，Cosmos Labs published a post disclosing that September 22 Neutron suffered a governance attack, resulting in liquidity being stolen from protocols including Astroport; approximately 1730000 tokens of ATOM were subsequently transferred by the attacker to Cosmos Hub。Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out further, Hub validators temporarily halted the network for approximately 24.5 hours, and on September 23 block production resumed based on the patched Gaia v28.3.0.Cosmos Labs stated that, during the halt, 1227000 tokens of ATOM remained in the attacker's Hub address and, upon network recovery, were transferred through a one-time change to a 4/6 multisig address comprising Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu.
Previously, approximately 500000 tokens of ATOM had been swapped for ETH through THORChain and cannot be recovered; another 169000 tokens of ATOM entered the attacker's address through a THORChain refund after the network recovered, and were transferred to Osmosis and sold.
The multisig address currently holds approximately 1227000 tokens of ATOM, which may be returned only after authorization by a Cosmos Hub governance proposal. The relevant funds will not be staked, lent, or traded.Neutron team expects to submit a recovery plan and related governance proposal next week.
Original link https://m.theblockbeats.info/flash/369054
Key points
01
BlockBeats stated that Cosmos Labs disclosed Neutron that September 22 suffered a governance attack, and liquidity from protocols including Astroport was stolen.
02
Approximately 1730000 tokens of ATOM were subsequently transferred by the attacker to Cosmos Hub。
03
Cosmos Hub itself was not attacked, and user funds were not affected.
04
To prevent the stolen ATOM from being transferred out further, Hub validators temporarily halted the network for approximately 24.5 hours, and on September 23 block production resumed based on the patched Gaia v28.3.0.
05
Cosmos Labs stated that, during the halt, 1227000 tokens of ATOM remained in the attacker's Hub address; when the network recovered, these ATOM were transferred through a one-time change to a 4/6 multisig address comprising Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu.
06
Previously, approximately 500000 tokens of ATOM had been swapped for ETH through THORChain and cannot be recovered.
07
Another 169000 tokens of ATOM entered the attacker's address through a THORChain refund after the network recovered and were subsequently transferred to Osmosis for sale.
08
The multisig address currently holds approximately 1227000 tokens of ATOM, which may be returned only after authorization by a Cosmos Hub governance proposal.
09
The relevant funds will not be staked, lent, or traded.
10
Neutron The team expects to submit a recovery plan and related governance proposal next week.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Neutron Following the governance attack, some of the stolen ATOM entered Cosmos Hub. To prevent further transfers of funds, validators halted the network and, upon recovery, transferred the 1227000 tokens ATOM still remaining at the attacker's Hub address to an address requiring joint action by at least 6 of 4 participants. These funds are currently only held in temporary custody; their return still requires authorization through a Cosmos Hub governance proposal.
Why it matters to readers
The incident involved a large amount of ATOM, a network halt, and governance authorization. 1227000 tokens ATOM have been placed in centralized custody, but approximately 500000 tokens ATOM are said to be unrecoverable, while another 169000 tokens have been transferred and sold, so fund recovery remains incomplete.
Beginners should distinguish between “transfer to multisignature custody” and “already returned”: currently, 1227000 tokens ATOM are still awaiting governance authorization. Multisignature means that fund operations require joint approval by multiple parties, but it does not mean that the return plan will necessarily pass.
Risks and unknowns
The materials do not provide the Cosmos Labs original announcement link; the disclosed information can currently only be verified against BlockBeats’ retelling.
Neutron The recovery plan and related governance proposal have not yet been submitted.
Cosmos Hub Whether governance will authorize the return, the recipients, and the specific implementation method have not yet been determined.
Related Developments
Loading event timeline…
Approximately 500000 tokens ATOM are said to be unrecoverable, and 169000 tokens ATOM are said to have been sold, but the materials do not provide on-chain transaction records for verification.
Related concepts
Governance attack
This term is not in the glossary yet. Browse related concepts in the glossary.
