Cosmos Hub Weighs Return of 1.23M Recovered ATOM After Neutron Governance Attack

A Cosmos Hub forum discussion published on 30 September 2026 proposes returning 1,227,121.37 ATOM recovered after the Neutron governance attack to a Neutron recovery multisignature wallet—but the tokens have not moved and two governance stages still stand between custody and user withdrawals.

The proposal is the latest verifiable step in a recovery process that began after an account passed Neutron governance proposal 9 on 22 September. According to the public recovery discussion, voting power was acquired for about 20,199 USDC, control over 11 contracts changed, and assets were removed from Drop and Astroport positions. A total of 1,723,180.29 ATOM was taken from three Neutron contracts and sent to the Cosmos Hub.

Cosmos Hub validators halted the chain at block 33,086,740. When the Hub restarted on 23 September using Gaia v28.3.0, a one-time state change transferred the 1,227,121.374688 ATOM still in the relevant address to a 4-of-6 recovery multisig. The Hub account says no other account, balance or delegation was touched. It also stresses that the Cosmos Hub itself was not exploited and Hub users did not lose funds.

What the proposal would authorise

The 30 September discussion is not an executable transfer. It describes a text proposal authorising the six Hub multisig signers—Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu—to move the recovered balance, less network fees, to a five-signer Neutron recovery multisig.

The route is a standard ICS-20 transfer over channel-569, beginning with a 1 ATOM test. Only after the test arrives would the remainder move. Transfer hashes, IBC acknowledgements and final balances would be published to the forum. A different destination would require another Hub proposal.

That design creates a verifiable execution trail, but it does not reimburse users by itself. After the ATOM reaches Neutron, a separate Neutron governance proposal is expected to return recovered assets to the original Drop and Astroport contracts. Users would then withdraw through the interfaces they used before the incident.

Recovery is substantial, but incomplete

The proposed transfer covers only ATOM secured on the Hub. The forum accounting says roughly 496,000 ATOM had already been sold through THORChain and Osmosis before the halt. A further 168,990.9 ATOM refund from THORChain reached the relevant address after the restart and was moved out. Those amounts are not part of the 1.23 million ATOM now in custody.

The Neutron recovery multisig also holds other recovered assets, including USDC, NTRN, ASTRO, dATOM and axlWETH, according to the proposal. Consolidating recoverable assets on Neutron would allow one governance process to restore affected contracts, but it also shifts custody from a Hub validator arrangement to a Neutron recovery group.

Neutron resumed block production on 25 September. The discussion says the network restored the 11 affected contracts to their original code and administrators, restricted governance so votes cannot repeat the same contract-control path, and froze new delegations. Those controls address the described route; they do not eliminate general smart-contract, governance or signer risk.

Market and governance implications

The proposal spends nothing from the Cosmos Hub community pool and changes no Hub parameter. Instead, it tests how a proof-of-stake network handles extraordinary intervention after stolen assets cross chain boundaries.

The constructive case is that validators contained a large portion of the stolen ATOM, documented the state change and are seeking a public mandate before the funds move again. A successful test, clear transaction receipts and two passed votes would convert emergency custody into a defined restitution path.

The bearish case is institutional. The Hub halted for about 24.5 hours and used a one-time state change to isolate funds. Even when the goal is recovery, traders and applications must price the possibility that validator coordination can interrupt finality or modify state in exceptional circumstances. Forum debate also shows disagreement over Hub costs, Neutron’s durability and the timing of user exits.

NetNapz assessment

Assessment: the proposal is a positive operational development, but not a completed recovery. Confirmation requires a published Hub proposal, a passed vote, a successful 1 ATOM test, the full transfer with public acknowledgements, and then a passed Neutron proposal restoring the original contracts. Until then, the ATOM remains under extraordinary multisig custody.

Invalidation: rejection of the Hub mandate, a destination or IBC mismatch, signer failure, a renewed Neutron security incident, or a claims dispute would weaken the restitution thesis. Unrecovered ATOM also means a successful transfer cannot make every affected position whole.

Horizon and risks: the forum outlined at least seven days of discussion, a seven-day Hub vote and a further execution window. Neutron governance follows. This is a process measured in weeks, not an immediate liquidity release.

What to watch

• Advancement to an on-chain Cosmos Hub text proposal.
• The vote and publication of the 1 ATOM test transaction.
• IBC acknowledgements and final multisig balances.
• The Neutron proposal returning assets to Drop and Astroport contracts.
• User withdrawal conditions after contract funding.

Sources

• Cosmos Hub Forum: proposed transfer of 1,227,121 recovered ATOM — 30 September 2026.
• Cosmos Labs: Hub response, halt and recovery update — 25 September, updated 29 September 2026.
• Cosmos Hub Weekly Update #18 — 1 October 2026.