Cosmos Hub halts for 25 hours after Neutron governance attack

Cosmos Hub validators successfully restarted the blockchain on September 23, 2026, after a 25-hour emergency halt. The freeze was initiated to secure $2.2 million in ATOM tokens stolen during a governance exploit on Neutron, where an attacker spent $20,199 to hijack Astroport and Drop smart contracts. While validators successfully seized 1.23 million ATOM, a subsequent THORChain refund allowed the attacker to escape with 169,000 ATOM, which they quickly liquidated on Osmosis.

Cosmos Hub network freeze

• ▪Cosmos Hub validators halted block production on September 22, 2026, at block height 33,086,740, keeping the network offline for nearly 25 hours
• ▪Cosmos Hub validators resumed block production at block 33,086,741 on September 23, 2026, at 12:00 UTC, ending the 25-hour network freeze triggered by the Neutron governance attack

Cosmos Hub security

• ▪Cosmos Hub validators halted the network to prevent the Neutron attacker from transferring, swapping, or bridging ATOM stolen from Neutron to other platforms
• ▪Cosmos Hub stated that its own network was not exploited during the Neutron governance attack and no user funds on the Hub were impacted

The Neutron governance exploit

• ▪The attacker behind Neutron governance proposal 9 acquired the necessary voting power by purchasing approximately 31.6 million NTRN tokens with 20,199 USDC and staking them less than 12 minutes before the Neutron vote closed on September 21, 2026
• ▪An attacker passed Neutron governance proposal 9, titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration," on September 21, 2026, which reassigned administrative rights over 11 smart contracts

Neutron pause and recovery

• ▪Neutron contributors prepared a new binary to restore the Astroport and Drop smart contracts affected by the Neutron governance attack to their original code, tighten governance controls, and target a network restart within 24 hours of September 24, 2026
• ▪Neutron was paused on September 22, 2026, trapping an estimated $5 million in assets and preventing the attacker behind the Neutron governance attack from moving them off the network

Debatable claims

• ▪Cosmos Hub's forced seizure of the attacker's funds was justified
• ▪Neutron's expedited governance mechanism poses an unacceptable security risk
• ▪Blockchain DAOs should not have administrative control over hosted applications