Cosmos Hub Restarts and Moves $2.1 Million in Stolen Tokens Out of an Attacker’s Wallet

The Cosmos Hub resumed producing blocks Wednesday morning after its validators halted the network for nearly 25 hours. In the first block committed after the restart, 1,227,121 ATOM, worth about $2.1 million, moved out of the wallet holding proceeds from a governance attack on Neutron.

The transfer appears in the block’s events without a transaction signed by the wallet’s owner, and it sent the tokens to a newly created address. On Tuesday, the Cosmos Hub account said validators were preparing a network update “intended to address the stolen ATOM currently held on the Hub.” Those posts do not say who controls the receiving address.

Just over a minute after the restart, a THORChain vault that had received two of the attacker’s earlier swaps sent back 168,991 ATOM, the unfilled part of a 200,000-ATOM swap submitted before the halt. Two minutes later, the attacker tried to send 500,000 ATOM to Osmosis, and the transfer failed for insufficient funds. The returned ATOM, worth about $294,000, was still in the wallet at 11:15 a.m. ET.

Neutron proposal 9, titled “AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration,” went through Neutron’s expedited track, which allows a three-day vote. It passed when voting closed at 10:24 p.m. ET on Monday, with about 82% of votes cast in favor, according to the on-chain record. Its summary described an experiment in which “Autonomous AI agents will take operational control of a live testnet.” The proposal itself carried 11 messages that handed admin control of Neutron contracts to the proposer’s own address.

Ten of those contracts belonged to the decentralized exchange Astroport and the liquid staking protocol Drop, according to an on-chain analysis that the X user Rarma published Tuesday. Rarma wrote that the account carrying most of the yes vote bought about 31.6 million NTRN with 20,199 USDC and staked it less than 12 minutes before voting closed. The vote “overrode two protocols’ own governance, on contracts the chain did not own,” Rarma wrote. The attacker then swapped the code of 10 of the 11 contracts and emptied them in less than half an hour, taking tokens Rarma valued at about $9.4 million. Rarma wrote that about $1.96 million of it sat on chains that were still running at the time.

Neutron has not produced a block since 3:43 a.m. ET on Tuesday, according to its public nodes. Spaydh, a former Neutron contributor, posted that the chain “was halted to prevent further harm.” Astroport told users in a post on X to “withdraw your liquidity from Astroport on all chains until further notice.”

Neutron moved into a long-term maintenance phase in June. In August, Cronos stopped its blockchain after an estimated $75 million exploit at lending protocol Tectonic.

In its restart notice Tuesday night, the Cosmos Hub account said the Hub itself “was not exploited and no funds were impacted apart from the assets moved from Neutron.”

Related Listen: How DeFi Remains Secure in a World of Always On AI Hacks: Uneasy Money

{"@context":"http:\/\/schema.org\/","@id":"https:\/\/unchainedcrypto.com\/cosmos-hub-restarts-and-moves-2-1-million-in-stolen-tokens-out-of-an-attackers-wallet\/#arve-youtube-zeiesplgqn8","@type":"VideoObject","embedURL":"https:\/\/www.youtube-nocookie.com\/embed\/ZEiespLGqN8?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0"}

The post Cosmos Hub Restarts and Moves $2.1 Million in Stolen Tokens Out of an Attacker’s Wallet appeared first on Unchained.