Cosmos hub halts for 24 hours after Neutron governance attack

Cosmos Hub validators halted block production on Tuesday, following a governance attack on Neutron which initially led to losses of $9.5 million.

Of that sum, the attacker was only able to extract around 20%, with the remainder stuck on halted networks.

With block production having resumed since 12:00 UTC on Wednesday, Cosmos Hub was ultimately offline for over 24 hours after halting at block height 33086740.

This latest incident marks the third security scare in recent months for the wider Cosmos ecosystem.

Read more: Cosmos Labs under fire over disclosure of bug affecting four blockchains

The governance attack

A malicious “AI Agent Takeover” governance proposal was passed on Neutron, a Cosmos-ecosystem chain which entered its “long-term maintenance phase” earlier this year.

The proposal allowed the attacker to take control of two Neutron-based applications, Astroport and Drop, and drain contracts of assets worth $4.9 million and $4.4 million, respectively.

The attacker reportedly spent just $20,199 to acquire the NTRN tokens needed to pass the vote.

The response

In response to the attack, Neutron was paused, trapping an estimated $5 million worth of assets.

In turn, Cosmos Hub validators also decided to halt, securing a further 1.2 million ATOM (over $2.2 million) held in the attacker’s address. The scheduled restart is set to include a queued refund of the trapped ATOM balance.

The hacker’s Ethereum address holds $1.8 million, with a further transaction worth over $300,000 pending on THORChain, though this is set to be refunded to the Cosmos Hub address upon restart.

Read more: Osmosis took 74 days to discover 40-BTC Nomic exploit

Chaos in the Cosmos ecosystem

In late August, a bug in Cosmos Labs’ Cosmos EVM module led to protocol-level exploits on four blockchains.

The disclosure procedure was heavily criticised by one of the affected projects, KiiChain, which dubbed the loss of $9 million worth of its KII tokens “avoidable.”

Earlier this month, Cosmos-based exchange Osmosis revealed that a June 25 exploit of Nomic’s bridge had minted 40 nBTC (worth $3.6 million at the time) out of thin air, which left Osmosis’ allBTC partially (36%) unbacked.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.