Cosmos Hub Restarts; 1.23 Million ATOM Moved From Neutron Attacker Wallet
The Cosmos Hub resumed operations after a pause that lasted 24 hours and 48 minutes. During the incident, 1.23 million ATOM were transferred out of an attacker-linked Neutron wallet, and the actor purchased voting power for 20,199 USDC, staking it 12 minutes before an expedited Neutron proposal closed.
Why It Matters
The prolonged block production halt and coordinated staking activity around a governance vote highlight potential vulnerabilities in cross-chain governance and validator responsiveness. Large token movements from an attacker-linked address and last-minute acquisition of voting power could influence on-chain decision-making and raise concerns for network security.
Key Facts
- Hub downtime: 24 hours and 48 minutes with no blocks produced
- ATOM moved: 1.23 million ATOM transferred from a Neutron attacker wallet
- Voting-power purchase: 20,199 USDC spent to buy voting power
- Timing of stake: Staked 12 minutes before an expedited Neutron proposal closed
- Network action: Cosmos Hub restarted
The Cosmos Hub has been restarted after a stoppage in block production that lasted 24 hours and 48 minutes. During the outage, validators produced no new blocks for nearly a full day, prompting a restart to restore normal operations.
Investigators linked the incident to activity on Neutron: 1.23 million ATOM were moved out of a wallet identified as belonging to an attacker. In addition to moving tokens, the actor purchased voting power for 20,199 USDC and staked those funds shortly before an expedited Neutron governance proposal concluded.
The stake was committed just 12 minutes prior to the closing of the expedited proposal, a timing detail that has been emphasized in reports about the event. Network operators and community members are likely to review both the sequence of transactions and validator behavior during the outage to determine how the actions intersected with governance and block production.
Cosmos Hub participants and observers are watching follow-up reporting and any formal postmortem from maintainers to understand root causes and potential mitigations. The combination of a lengthy block-production halt, large token movements from an attacker-linked address, and proximate staking around a governance vote has focused attention on cross-chain governance mechanics and operator readiness.