Cosmos Labs disclosed that Neutron transferred to Cosmos Hub after the attack, 1227000 tokens of ATOM have been transferred to 4/6 multisig address, pending authorization for return through a governance proposal. Approximately 500000 tokens of ATOM can no longer be recovered.
After an expedited Neutron governance proposal was manipulated, the attacker allegedly stole approximately US$4.4 million. Cosmos Hub validators halted the chain for nearly 25 hours and transferred approximately 1.23 million ATOM from the attacker's wallet during the restart.
A Telegram message states that Cosmos Hub operations resumed after a 24-hour shutdown; before the shutdown, an attacker increased their voting power over Neutron the proposal through staking.