Cosmos intercepts 1.23 million stolen ATOM but refunds now wait on governance vote
After a Sept. 22 governance attack on Neutron, the attacker sent about 1.73 million ATOM to the Cosmos Hub. Hub validators halted the chain and restarted it with a one-time software patch that moved 1,227,121 ATOM from the attacker-linked address to a six-validator recovery multisig. The Hub itself was not exploited. The signers say they will release the secured funds only after a Hub governance proposal authorizes the transfer; no such mandate had passed by Sept. 26. Neutron contributors and affected protocols were preparing evidence and a distribution plan, but recipients and reimbursement amounts remained unresolved. About 500,000 ATOM had already been swapped before the halt, and a later 168,991 ATOM refund missed the patch and was moved and sold.
