Cosmos intercepts 1.23 million stolen ATOM as refunds await vote

Cosmos Hub validators secured 1,227,121.37 stolen ATOM through an emergency software patch. The attacker had moved roughly 1.73 million stolen ATOM from Neutron to the Hub during a Sept. 22 governance attack. The Hub was not exploited. It became the place where part of the stolen balance could be intercepted. Validators halted the chain at height 33,086,740. They restarted it with Gaia software version 28.3.0. The patch made a one-time state change that transferred the ATOM from an attacker-linked address to a recovery multisig. The transfer took effect at about 12:06 UTC on Sept. 23. Validators representing more than 67% of Hub voting power had confirmed installation before the restart. Blocks resumed at 12:00 UTC. The recovery address held 1,227,121.374688 ATOM at 15:40 UTC on Sept. 26. The patch applied only to one source account. It did not change other user balances or delegations. The six multisig signers are Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. Any four signatures meet the wallet's technical threshold for a transaction. The signers say a passed Hub governance proposal must authorize a legitimate transfer before they release the funds. Cosmos Labs says it has no key to the wallet. The emergency patch did not identify every valid claimant. It did not approve a distribution schedule. Cosmos Labs said the Neutron response team was preparing evidence and a distribution plan. Contributors and affected protocols, including Astroport and Drop, were preparing evidence of what was taken and where recovered assets should go. The response team was expected to bring or support a Hub proposal in the following week. The Hub proposal list showed no passed mandate for the recovery multisig at 15:40 UTC on Sept. 26. Proposal 1056, titled "ATOM Refund & Justice Bounty," was still in voting. It did not authorize the Neutron response team's distribution from this multisig. Cosmos Labs said roughly 500,000 ATOM had already been swapped through THORChain before the halt. Other stolen assets reached networks beyond the Hub. The recovery does not establish the final size of each affected account's claim. It does not promise full reimbursement. Another 168,990.9 ATOM reached the attacker address through a pending THORChain refund just after the restart. Validators knew the refund might arrive. Capturing it would have required different code and a longer halt. The returned ATOM was moved to Osmosis and sold. The Neutron recovery plan must still establish who is owed what and where the funds should go.