Cosmos Hub Restarts After Neutron Governance Attack Triggers 25-Hour Halt

Cosmos Hub resumed block production at 12:00 UTC after validators installed Gaia v28.3.0 and applied a one-time state change at the halted height of 33,086,741, according to a Cosmos Hub Forum update. The restart enabled the transfer of 1,227,121 ATOM remaining in an address tied to the Neutron attacker into recovery custody.

The network interruption lasted about 24 hours and 48 minutes, based on block timing reported after the restart by PrimeXBT. Cosmos Hub said it was not directly exploited in the underlying incident.

Gaia v28.3.0 restart ends the halt at block 33,086,741

Validators coordinated the software upgrade and state change before block production restarted. The intervention occurred while the chain was halted, allowing the network to address ATOM that had arrived on the Hub from the attacker-linked address.

The roughly 25-hour pause was precautionary, according to the reported sequence of events. The available updates do not describe a direct compromise of Cosmos Hub’s own systems; rather, the Hub’s response focused on funds connected to the separate Neutron incident.

Recovery multisig receives 1,227,121 ATOM from the attacker address

Following the restart, the 1,227,121 ATOM still held at the Neutron attacker’s address was moved to a 4-of-6 recovery multisig, Cosmos Hub validators reported in the forum update. The transfer was the immediate on-chain result of the coordinated restart process.

The update identifies the multisig’s approval threshold but does not provide further detail on the eventual handling or distribution of the recovered ATOM.

Neutron governance proposal created the cross-chain exposure

Cosmos Hub’s account describes a deceptive Neutron governance proposal that gave an attacker administrative control over contracts. The attacker used that control to drain protocol funds and transfer ATOM to Cosmos Hub through IBC.

The Hub said it was not itself exploited, distinguishing the Neutron governance attack from its own role in the response.

The cross-chain transfer put attacker-linked ATOM on Cosmos Hub and was followed by a halt and recovery action.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.