Cosmos Hub restarts after 25-hour halt, moves $2M in stolen tokens

Rarma: Rarma is an on-chain analyst active on X who examined the governance proposal details following the attack. His analysis identified how the vote was structured, including the timing of stake acquisition, and detailed the contracts impacted on Astroport and Drop. The breakdown helped clarify the mechanics of the exploit for the community. Spaydh: Spaydh is a former contributor to the Neutron blockchain project with insight into its operations. He publicly noted that the chain halt was implemented specifically to prevent additional harm from the ongoing exploit. His comments align with the broader validator response across the ecosystem. Neutron: Neutron is a Cosmos ecosystem blockchain designed for smart contract execution and interoperability with other chains. It was targeted by a governance proposal that passed on its expedited track, granting the attacker admin control over multiple contracts including those of Astroport and Drop. The chain has remained halted since the incident to prevent further exploitation. Astroport: Astroport operates as a decentralized exchange on Neutron and other chains, providing liquidity and trading services. Ten of its contracts were among those compromised when admin control was seized through the governance attack, prompting user advisories to withdraw liquidity. The protocol continues to monitor the situation across affected chains. THORChain: THORChain is a decentralized cross-chain liquidity protocol that facilitates atomic swaps between assets on different blockchains. One of its vaults returned a portion of tokens from an unfilled swap initiated by the attacker shortly after the Cosmos Hub restart. The protocol's involvement highlights ongoing interactions with funds tied to the Neutron exploit. Cosmos Hub: Cosmos Hub is the central blockchain coordinating security and governance across the Cosmos ecosystem through its validator set. Its validators halted block production in response to a governance attack on the connected Neutron chain to limit potential damage. Upon resuming operations, the network processed the movement of funds from the attacker's wallet as part of the recovery process. Governance Risks: The incident involved an expedited governance proposal on Neutron that overrode controls on contracts not owned by the chain itself. AI Agent Experiments: The attack proposal framed itself as an experiment granting operational control to autonomous AI agents on a testnet. Ecosystem Coordination: Validators across Cosmos Hub and Neutron collaborated on halting activity to contain the effects of the governance exploit.