Cosmos Hub voters reject proposal to refund Neutron attacker 1.2 million ATOM

Cosmos Hub voters are overwhelmingly rejecting governance proposal 1056, which seeks to refund 1.2 million ATOM to the Neutron attacker. The proposal, titled "ATOM Refund & Justice Bounty," claims validators unjustifiably stole the funds and offers a 500,000 ATOM incentive to yes voters. However, approximately 95% of cast votes are "No with Veto." The funds remain secured in a validator-controlled multisig wallet following a chain halt and restart that neutralized the attack.

Voting on governance proposal 1056

• ▪Cosmos Hub governance proposal 1056, titled "ATOM Refund & Justice Bounty," was submitted on September 23, 2026, and is scheduled to close for voting on September 30, 2026.
• ▪Cosmos Hub governance proposal 1056 will fail and its 500 ATOM deposit will be burned if turnout meets the 40% threshold and "No with Veto" votes remain above 33.4%.
• ▪Cosmos Hub voters are overwhelmingly rejecting governance proposal 1056, which seeks to refund 1.2 million ATOM to the Neutron attacker, with "No with Veto" votes representing approximately 95% of the 69.3 million ATOM cast as of September 25, 2026.

Terms of governance proposal 1056

• ▪Cosmos Hub governance proposal 1056 requests 1,221,120 ATOM to be returned from the community pool, claiming that Cosmos Hub representatives and validators unjustifiably stole the funds.
• ▪Cosmos Hub governance proposal 1056 offers a 500,000 ATOM "Justice Bounty" to be split among yes voters based on staking weight, paid over six months and capped at 5,000 ATOM per voter.

Proposal submission address

• ▪The message attached to Cosmos Hub governance proposal 1056 would pay 1,721,120 ATOM from the community pool to the address that submitted the proposal.
• ▪The address that submitted Cosmos Hub governance proposal 1056 is different from the address that was swept by the Cosmos Hub validators.

Seizure of the attacker's funds

• ▪The Cosmos Hub team stated in their weekly update on September 24, 2026, that there was no vulnerability on the Cosmos Hub and that the patched software affected only one account.
• ▪The 1,227,121 ATOM seized from the Neutron attacker's address is held in a 4-of-6 multisig wallet requiring approval from at least four of six Cosmos Hub validators: Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu
• ▪Cosmos Hub validators halted and restarted the blockchain on September 23, 2026, to move 1,227,121 ATOM from the Neutron attacker's address into a secure multisig wallet

Attacker's other transaction activity

• ▪An attacker who exploited a Neutron governance vote received a refund of 168,990.9 ATOM from THORChain on September 23, 2026, after a 200,000 ATOM swap for ether on September 22, 2026, hit its price limit
• ▪The Neutron attacker transferred 168,990 ATOM to an Osmosis address over the Inter-Blockchain Communication Protocol on September 23, 2026.

Debatable claims

• ▪Incentivizing governance votes with financial bounties corrupts blockchain decision-making
• ▪Blockchains should never halt their networks to reverse transactions
• ▪Cosmos Hub validators were justified in seizing the Neutron attacker's ATOM
• ▪Burning the deposits of vetoed governance proposals is a fair way to deter spam