Cosmos Hub Secures 1.23M Stolen ATOM, Refunds Await Vote

Neutron Attack Losses Extend Beyond Recovered ATOM

As of September 27 at 21:05 UTC, the best-supported Hub accounting was Cosmos Labs’ September 25 report: about 1.73 million ATOM arrived, and 1,227,121.37 ATOM was secured. The report describes roughly 500,000 ATOM routed through THORChain before the halt and a later 168,990.9-ATOM refund that escaped recovery.

The Cosmos Labs recovery account says the refund reached the attacker after restart, then moved to Osmosis and was sold. These legs should not be added into a new theft total without reconciled accounting.

SlowMist’s incident tracker lists approximately $4.9 million for Astroport and $4.4 million for Drop. It describes compromised administrator privileges at Astroport and a malicious governance proposal affecting Drop’s treasury.

Those figures identify reported protocol impacts, but the tracker does not establish a final combined net loss after recoveries. Different dollar valuations, asset routes and reporting scopes make a mechanically summed headline potentially misleading.

Unchained’s September 23 reconstruction cited analyst Rarma’s estimate of about $9.4 million drained. It also reported that the recovered ATOM was worth about $2.1 million at that time. Those dated estimates are distinct from today’s token price and from final victim losses.

The report described a three-day expedited proposal with 11 administrator-change messages, presented as an AI-agent experiment. It cited on-chain analysis that roughly 31.6 million NTRN was bought for 20,199 USDC and staked shortly before voting closed.

That reconstruction points to governance permissions as the attack path. The article’s reviewed sources did not establish a verified victim-wallet count or a separate subsequent attack wave. A full recovery total requires identifying losses and returns across all affected destinations.

Cosmos Hub Halt Secured One Attacker Balance

The Hub Unit said validators halted the chain, installed Gaia v28.3.0 and restarted September 23 at 12:00 UTC. The patch applied a one-time change to the attacker’s balance, rather than reversing every transaction in an interval of chain history.

Its recap identifies a four-of-six recovery multisig controlled by Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. At least four signers must approve a movement. Custody is therefore a defined signing arrangement, rather than an automatic reimbursement mechanism.

The official Hub documentation describes ATOM’s role in security and on-chain governance. Separate connected blockchains can exchange assets, but the existence of that connection does not give one network control of balances everywhere those assets travel.

That boundary also appeared in Cronos’s Tectonic rollback accounting, where funds that had left the network remained outside the rollback’s reach. The Hub’s single-account intervention used a different method, with a similar limit on cross-chain recovery.

The later THORChain refund illustrates the difference between containing an existing balance and intercepting future arrivals. A patch designed around one balance at one moment cannot be assumed to capture every subsequent transfer.

For ordinary users, network availability and loss exposure are separate questions. A recovery halt interrupts legitimate activity even when those users’ balances are not the source of the exploit. Resumed block production likewise does not establish that every affected protocol has settled claims.

ATOM Refunds Require a Hub Governance Mandate

Cosmos Labs says the signers will release funds only after a passed Hub governance proposal authorizes the transfer. The Neutron response team expected to prepare that proposal in the coming week, alongside its fuller incident report.

The same update says the signers will not stake, lend or trade the held assets. Neutron had relaunched with mitigations by September 25, but a resumed network and a completed compensation plan are different milestones.

The next decision needs a clear connection between the recovered pool and the claims it is intended to satisfy. A transfer authorization can establish where custody moves; it does not, by itself, demonstrate that every victim receives a full reimbursement.

The distinction between a fix and a measured outcome also runs through the recent XRP Ledger emergency patch. Here, observed theft and a reported recovery exist, so the remaining questions concern distribution and residual losses.

Alternative.me’s Bitcoin-focused Fear and Greed Index read 70, or Greed, September 27. Broad market sentiment does not measure the completeness of this recovery.

A final reconciled loss total, recipient-level refund schedule and independently confirmed completion of returns were not established in the reviewed material. The next substantive milestones are the recovery proposal, its vote and evidence of authorized payments.