Cosmos Recovered 1.23M ATOM, but Holders Still Await Refunds

Validators intercepted 1,227,121.37 ATOM from the Neutron attacker, but affected holders cannot claim the funds yet. A Cosmos Hub governance proposal must authorise a transfer from the recovery multisig, and no such mandate had passed as of 15:40 UTC on Sept. 26.

The chain halt has ended. Blocks resumed on the Cosmos Hub at 12:00 UTC on Sept. 23, and the one-time recovery transfer took effect about six minutes later.

What the recovery patch did

The attack began on Neutron on Sept. 22. According to the Hub maintainers, a governance proposal gave the attacker administrative control over contracts used by Astroport and other protocols.

The attacker moved roughly 1.73 million stolen ATOM from Neutron to the Cosmos Hub. The Hub itself was not exploited. It became the place where part of the stolen balance could still be intercepted as the attacker swapped and bridged the tokens.

Hub validators halted the chain at height 33,086,740. They restarted it with patched Gaia software, v28.3.0. At the first block after the halt, the patch moved 1,227,121.37 ATOM from the attacker-linked address to a recovery multisig.

The software was limited to that source account. Cosmos Labs said it did not alter other users’ balances or delegations.

This was a coordinated software update, not an on-chain vote approving compensation. Validators with more than 67% of Hub voting power had installed the binary before the restart. Cosmos Labs said they were given the source and destination addresses, the six proposed signers and the proposed scope before it distributed the code.

The six multisig signers are Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. Four signatures meet the wallet’s technical threshold for a transaction.

No refunds have been authorised

The signers said the multisig can make a legitimate transfer only after a Cosmos Hub signalling proposal passes. Cosmos Labs also said it does not hold a key to the wallet.

The emergency patch did not determine every valid claimant or approve a payment schedule. The recovery address held 1,227,121.374688 ATOM when checked at 15:40 UTC on Sept. 26, but holding the tokens does not authorise their distribution.

Neutron’s response team was expected to bring or revive a Hub proposal in the week after Sept. 25. As of the governance check at 15:40 UTC on Sept. 26, the Hub’s visible post-incident proposal list contained no passed mandate for the recovery multisig.

Proposal 1056, titled “ATOM Refund & Justice Bounty,” was still in voting. It sought a different refund and bounty arrangement and did not authorise payment from this multisig. The latest visible proposal, 1057, concerned recovery of a Realio IBC light client.

Contributors and affected protocols, including Astroport and Drop, were preparing evidence of their losses and where recovered assets should go. Their work does not itself establish who qualifies for payment. The number of eligible victims and the final size of each claim remain unknown.

The recovery window was not complete

Cosmos Labs said roughly 500,000 stolen ATOM had already been swapped through THORChain before the Hub halt. Other stolen assets also reached networks outside the Hub.

Another 168,990.9 ATOM arrived from a pending THORChain refund shortly after the patched software had executed. It reached the attacker’s address after the one-time transfer was complete. Cosmos Labs said capturing it would have required different code and a longer halt. The returned ATOM was then moved to Osmosis and sold.

The intercepted balance is therefore the amount moved by the patch, not the full amount stolen or the amount now available to compensate every affected party.

What changes for holders

The halt and the multisig transfer are finished. Recovery is now waiting on governance, evidence of losses and a mandate that allows the six signers to release the funds.

Until a proposal passes, affected holders do not have a confirmed claim, payout amount or payment date. Later Hub or Neutron votes were not established by the available reporting.