[DISCUSSION] Move the 1,227,121 ATOM recovered after the Neutron exploit to the Neutron recovery multisig

Hub Proposals
1

TL;DR

The Cosmos Hub recovery multisig holds 1,227,121.37 ATOM that was stolen from Neutron contracts on 22 September. We plan to submit a Hub text proposal that authorizes its signers to send this ATOM over IBC to the Neutron recovery multisig, neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy. A later Neutron governance proposal will then return all recovered funds, including this ATOM, to the original Neutron contracts they were taken from.

The proposal spends nothing from the community pool, changes no Hub parameter, and executes no on-chain message. We would like feedback before submitting it.

What happened

On 22 September 2026 an attacker passed Neutron governance proposal 9 with stake bought for about 20,199 USDC. The proposal handed 11 Neutron contracts to the attacker, who replaced their code, emptied them and bridged the proceeds to other chains. All 1,723,180.29 ATOM taken went to the attacker’s address on the Cosmos Hub, cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n. The attacker had sold about 496,000 of it through THORChain and Osmosis by the time the Hub halted.

Hub validators halted the chain at block 33,086,740. On 23 September the Hub restarted on Gaia v28.3.0 with a one-time state change at height 33,086,741. It moved the 1,227,121.374688 ATOM still on the attacker’s address to a 4-of-6 recovery multisig, cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64. No other account, balance or delegation was touched. The signers are Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu.

The signers took custody on one condition: they will move the funds only after a passed Cosmos Hub governance proposal gives them a mandate. This proposal would give them that mandate.

The full post-mortem, with the attacker’s addresses and the key transactions, can be found here: Solva (CryptoCrew) on X: "https://t.co/NeRy8wYq6D" / X

Where the ATOM came from

The ATOM was withdrawn from three Neutron contracts, where it was held for Drop and Astroport users:

Neutron contract ATOM taken
Drop dATOM → ATOM converter (neutron15024…4kqj9) 1,589,711.919394
Drop withdrawal manager (neutron1gckl…2uumck) 115,878.183542
Astroport ATOM/dATOM pool (neutron1yem8…2e98) 17,590.187562
Total 1,723,180.290498

What we propose

A text proposal on the Hub. If it passes, the Hub community authorizes the signers of the Hub recovery multisig to:

  1. Send the multisig’s full ATOM balance, less network fees, to the Neutron recovery multisig, neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy.
  2. Use a standard ICS-20 transfer from the Hub over channel-569 (Neutron channel-1), with an empty memo and a timeout long enough to cover a relayer outage. On Neutron the ATOM arrives as ibc/C4CFF46FD6DE35CA4CF4CE031E643C8FDC9BA4B99AE598E9B0ED98FE3A2319F9.
  3. Send a small test transfer first, for example 1 ATOM, and send the rest only after it has arrived.
  4. Publish the hashes of every transfer and its IBC acknowledgement, and the final balances of both multisigs, in this thread.

The signers may not send the ATOM anywhere else. A different destination would need a new Hub proposal.

Why move it to Neutron

  • It belongs to Neutron users. The ATOM was taken from Drop and Astroport contracts on Neutron.
  • The Hub was not exploited. The Hub only received the stolen funds. Its validators, users and community pool lost nothing, and nothing here asks the Hub to pay for anything.
  • One custody point for all recovered funds. The Neutron recovery multisig already holds everything recovered on Neutron: 1,671,302 USDC, 95.2 million NTRN, 370.3 million ASTRO, the stolen dATOM, 14.09 axlWETH and smaller balances. Its signers are 01node, Stake&Relax, Polkachu, Newt Node and Solva. With the ATOM there as well, a single Neutron proposal can return everything.
  • The return belongs on Neutron. The contracts and the affected positions are on Neutron, so Neutron governance is the right place to approve how the funds go back.

What happens next on Neutron

After the ATOM arrives, a Neutron governance proposal will be submitted to return all recovered funds, the ATOM included, to the original contracts they were taken from. Those contracts are back on their original code and admins since Neutron’s recovery release on 25 September. Once the funds are back, users can withdraw through the original Drop and Astroport interfaces.

The Neutron multisig signers have committed to the same rule as the Hub signers: no transfer without a passed Neutron governance proposal. Until that proposal passes, the ATOM stays in the Neutron recovery multisig.

What the proposal does not do

  • It does not spend from the community pool or change any Hub parameter or module.
  • It does not execute an on-chain message. The multisig signers send the transfer with their own keys.
  • It does not decide how the funds are returned on Neutron. Neutron governance decides that.
  • It does not cover ATOM that was not recovered. That includes the roughly 496,000 ATOM sold before the halt and the 168,990 ATOM THORChain refund that reached the attacker after the restart.
  • It does not change the multisig’s signers or threshold.

Risks

  • Wrong destination. The Neutron address appears in the proposal title, summary and body. The signers check it against this thread and send a test transfer first.
  • IBC failure or timeout. A failed or timed-out ICS-20 transfer is refunded to the Hub multisig, so nothing is lost. The test transfer surfaces such problems early.
  • Neutron rate limits. Neutron has no ICS-20 rate limit for ATOM on channel-1, so we expect a single transfer. If a technical limit does get in the way, the signers may split the transfer, but they may not hold any ATOM back.
  • Signer key compromise. The multisig is 4-of-6 across independent organizations. Moving the funds reduces the time they sit in a Hub-only custody arrangement.

Timeline

  1. Forum discussion for at least 7 days.
  2. On-chain text proposal with a 7-day voting period.
  3. If it passes, the signers send the test transfer and then the full transfer, and report back here within 7 days.
  4. The Neutron proposal to return all recovered funds to the original contracts follows.

Feedback we are looking for

  • Any objections to moving the ATOM to Neutron’s custody before the Neutron return proposal passes, rather than after.
  • Anything missing from the transfer conditions.
  • Anything from the signers about how they will execute it.
1 Like
Neutron Governance Attack: Cosmos Hub Response and Recovery Update
2

Why send Atom to a dead chain would be usefull ?

3

Thanks for the question, it’s a fair one.

Neutron isn’t dead. It resumed block production on 25 September with a recovery release. That release put all 11 affected contracts back on their original code and admins, and locked both attacker accounts.

The ATOM needs to go back because it belongs to Neutron users. It was taken from the Drop dATOM converter, the Drop withdrawal manager and the Astroport ATOM/dATOM pool. While it’s missing, those contracts can’t pay out what users are owed. Returning it to the original contracts lets those users withdraw their positions and offboard if they want to, including bridging their ATOM back to the Hub. Leaving it in a Hub multisig helps nobody.

On whether this could happen again: the release closed the path proposal 9 used. For now, Neutron governance only accepts software-upgrade and text proposals, so a vote can no longer change contract admins, migrate contracts or move funds. New delegations are also frozen, so nobody can buy voting power the way the attacker did. The ongoing protections are enforced at several layers, which also covers calls made through smart contracts, interchain accounts and authz.

The return itself also needs a separate Neutron governance proposal. Until that passes, the ATOM stays in the Neutron recovery multisig.

4

Neutron will shutdown right ?

5

It would help if the community wants to use it via gov

6

The current plan is to keep the infrastructure running so users can offboard in an orderly way. That is also why the ATOM needs to go back to the original contracts: without it, Drop and Astroport users can’t withdraw what they are owed. On Solva’s side, we have committed to several months of repository and infrastructure maintenance (until 07/2027). What happens after that is up to Neutron’s validators and community.

7

It would help if the community wants to use it via gov

Technically, yes, the Hub community could vote to use the ATOM another way. But these funds aren’t unclaimed or ownerless. They belong to specific Drop and Astroport users on Neutron, whose ATOM was stolen out of those contracts. The Hub stopped the attacker from selling it, which is exactly what makes returning it possible.

So personally I’d strongly oppose any use other than returning it to its owners. But it’s a legitimate question, and that’s what this discussion is for. In the end it’s the Hub community’s vote.

8

Sharing my thoughts here quickly on this (purely as a Cosmos Hub community member. These views do not represent Cosmos Labs).

The ATOM in that multisig is toxic. Appropriating it for the Hub’s own use puts the entire community pool at risk of claims by impacted users on Neutron for years to come. We should keep it as far away from the Hub community pool as possible.

Imo, the funds should be sent back to the Neutron multisig so their community can deal with it accordingly, as the party that is best positioned to understand the needs of their own users.

Also, choosing not to keep funds out of the hands of the people it was stolen from is the morally right thing to do, so there’s that.

1 Like
9

Why not take a snapshot of the ATOM holders on the Neutron side and return those ATOM to them on a Cosmos Hub address?

10

It makes sense, but people may not have known that Neutron was planning to shut down. They continued using the chain, remaining exposed to all the associated risks. We should migrate the Astroport contracts to the Hub and give those users a reason to move their DeFi activity to the Cosmos Hub instead.

11

Thanks for driving the next steps on this.

Personally, I’m aligned on the goal: get the funds to where the affected teams and the response team can coordinate restitution, close out the multisig and the Hub’s involvement as soon as possible to limit their exposure, and let users decide from there what they want to do with their assets.

What the protocols or Neutron do afterwards for wind-down is a separate matter and, in my view, out of scope here to try solve all at once.