Cosmos Hub restarts after 25-hour halt, moves $2M in stolen tokens from attacker’s wallet

The Cosmos Hub is back online after validators pulled the emergency brake for 25 hours, freezing the network to prevent a governance attacker from moving roughly 1.2 million ATOM, worth over $2.2 million, off the chain. The coordinated halt, which began at block height 33086740 on September 22, ended at 12:00 UTC on September 23 when normal block production resumed. As part of the restart, the network successfully moved the stolen ATOM out of the attacker’s wallet. A $20K exploit that nearly cost $9.5 million The root cause wasn’t on the Cosmos Hub itself. It started on Neutron, a smart contract platform in the Cosmos ecosystem, where an attacker used a governance proposal to seize control of two applications: Astroport and Drop. The total cost of entry for the attacker was about $20,200 in NTRN tokens. The payout was considerably more generous, with contracts worth an estimated $9.5 million exposed to draining. The attacker managed to extract roughly 20% of those contract values before Neutron independently halted its own operations, trapping about $5 million in assets. The problem was that a portion of the stolen funds, specifically 1.2 million ATOM, had already made it to a Cosm...