Cosmos Hub recovers $2.2 million in ATOM, but 169,000 escape

Cosmos Hub restarted after a nearly day-long halt and moved 1,227,121.37 ATOM from an attacker-linked address. The ATOM was worth about $2.2 million. Validators resumed block production on Sept. 23 after stopping the network a day earlier. The restart began at block 33,086,741. The upgrade moved the attacker-linked balance into a recovery address before ordinary activity continued. Cosmos Hub said its network was not exploited. Cosmos Hub said the halt secured assets bridged from Neutron. The secured assets were placed in a community validator multisig. Former Neutron contributor Spaydh said an attacker accumulated enough NTRN voting power to pass an expedited governance proposal. The proposal reassigned administrative rights over 11 smart contracts. The affected contracts included infrastructure used by Astroport and Drop. The contracts were migrated to malicious code that allowed assets to be withdrawn. Spaydh estimated the initial impact at roughly $4.4 million. The estimate included about $3 million in ATOM. It included $1.2 million in USDC. It included around $100,000 in DYDX. It also included smaller amounts of wstETH and WETH. A previous estimate put the losses at roughly $9.3 million. Neutron rate limits and a later halt prevented some assets from leaving the network. Spaydh said more than $1.6 million in USDC was protected. He also said significant amounts of NTRN and ASTRO were protected. Roughly 70 percent of the stolen ATOM remained on Cosmos Hub when validators stopped block production. About $2.15 million in ATOM was then within reach of the recovery operation. A later THORChain refund reached the attacker after the recovery transaction had executed. Crypto analyst Rarma said 168,990.9 ATOM arrived at the attacker-linked address seven blocks after the restart. The tokens remained there for almost six hours. The attacker transferred the tokens to Osmosis. The attacker sold them in batches for about 266,841 USDC. Much of the proceeds was later converted into Ethereum. Rarma said an earlier attempt to transfer 500,000 ATOM failed because the wallet lacked sufficient funds. He said the transaction showed that the attacker-linked address could still submit an IBC transfer after the restart. Cosmos Hub has not publicly explained why the later transfer proceeded. Cosmos Hub has not said whether additional restrictions were intended for funds reaching the address after the initial sweep. Cosmos Hub said the recovered ATOM remains under community control. Cosmos Hub said Hub validators, Neutron participants, and affected protocols are coordinating the funds' return. Spaydh said contributors prepared a new binary that would restore affected contracts to their previous code and administrators. The binary would also tighten governance controls. It would move remaining attacker-controlled assets into a validator multisig. The asset-return process is still being finalized. Recovered funds are expected to return to their original contracts and users after Neutron resumes block production. Spaydh said Neutron was targeting a restart within roughly 24 hours. He said asset returns were expected to begin afterward. The project plans to publish a full post-mortem after the chain returns online. Cosmos Hub said it will provide further details on the secured ATOM in a separate forum update.