Cosmos hub halts for 24 hours after Neutron governance attack
Cosmos Hub validators halted block production on Tuesday, following a governance attack on Neutron which initially led to losses of $9.
Cosmos Hub validators halted block production on Tuesday, following a governance attack on Neutron which initially led to losses of $9.5 million.
Of that sum, the attacker was only able to extract around 20%, with the remainder stuck on halted networks.
With block production having resumed since 12:00 UTC on Wednesday, Cosmos Hub was ultimately offline for over 24 hours after halting at block height 33086740 .
This latest incident marks the third security scare in recent months for the wider Cosmos ecosystem.
Cosmos Hub validators will restart the network at 12:00 UTC on September 23 (08:00 EDT). Reminder: the Hub itself was not exploited and no funds were impacted apart from the assets moved from Neutron. More details https://t.co/6LlvUjpKIj
— Cosmos Hub (@cosmoshub) September 23, 2026
Read more: Cosmos Labs under fire over disclosure of bug affecting four blockchains
The governance attack
A malicious “AI Agent Takeover” governance proposal was passed on Neutron, a Cosmos-ecosystem chain which entered its “long-term maintenance phase” earlier this year.
The proposal allowed the attacker to take control of two Neutron-based applications, Astroport and Drop, and drain contracts of assets worth $4.9 million and $4.4 million, respectively.
The attacker reportedly spent just $20,199 to acquire the NTRN tokens needed to pass the vote.
The response
In response to the attack, Neutron was paused , trapping an estimated $5 million worth of assets.
In turn, Cosmos Hub validators also decided to halt, securing a further 1.2 million ATOM (over $2.2 million) held in the attacker’s address. The scheduled restart is set to include a queued refund of the trapped ATOM balance.
The hacker’s Ethereum address holds $1.8 million, with a further transaction worth over $300,000 pending on THORChain, though this is set to be refunded to the Cosmos Hub address upon restart.
Read more: Osmosis took 74 days to discover 40-BTC Nomic exploit
Chaos in the Cosmos ecosystem
In late August, a bug in Cosmos Labs’ Cosmos EVM module led to protocol-level exploits on four blockchains.
The disclosure procedure was heavily criticised by one of the affected projects, KiiChain, which dubbed the loss of $9 million worth of its KII tokens “avoidable.”
Earlier this month, Cosmos-based exchange Osmosis revealed that a June 25 exploit of Nomic’s bridge had minted 40 nBTC (worth $3.6 million at the time) out of thin air, which left Osmosis’ allBTC partially (36%) unbacked.
Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel.
The post Cosmos hub halts for 24 hours after Neutron governance attack appeared first on Protos .