Cosmos Hub validators transferred 1,227,121 ATOM, valued in the source report at about $2.1 million, out of the wallet tied to the Neutron exploit when the network resumed on Wednesday. The move was recorded as a block event and, according to the report, did not require a signature from the wallet owner.

The transfer followed a chain freeze that began Tuesday and lasted for nearly 25 hours before the hub was brought back online. The source report said the Cosmos Hub itself was not compromised and that the incident affected Neutron-related assets.

State-level transfer executed at restart

According to the source report, the chain halted at a block and validators carried out the balance move as part of the restart process. Rather than a normal user-signed transaction, the withdrawal was applied directly at the state level when the network resumed.

Cosmos Hub announced on X that the restart took place at 12:00 UTC on September 23, 2026. After the restart, the seized tokens were reported to be held at cosmos1z8pq5c, an address with no known signer.

One refund escaped after the freeze

Not all funds were contained. The report said a 168,990 ATOM refund from a THORChain order reached the exploiter-linked wallet at 12:07 UTC after the restart. That order had not fully executed, resulting in the refund.

Two minutes later, at 12:09 UTC, there was a 500,000 ATOM send to Osmosis, but it failed because the wallet only held about a third of that amount. On-chain records cited in the report show that the owner later bridged the refunded 168,990 ATOM to an Osmosis address controlled by the same key at 17:54 UTC.

How the Neutron exploit was carried out

The source article traced the broader incident to governance manipulation on Neutron. It said a $20,199 vote secured admin control over 10 Astroport and Drop contracts.

Those funds reportedly came through Neutron proposal 9, filed on Sept. 19 under an expedited process. The proposal passed with 81.88% support and enabled 11 MsgUpdateAdmin messages that made the proposer’s key the admin. According to the report, the attacker first voted yes with roughly 100 NTRN, then spent 20,199 USDC to acquire 31.6 million more NTRN and staked the tokens before voting closed.

Scale of the affected contracts

After gaining control, the attacker drained 10 Astroport and Drop contracts, the report said. Astroport Treasury was described as largely unaffected.

The same report put Neutron’s total bonded stake at roughly $113,000, while the contracts involved were guarding about $9.4 million. That gap helps explain why the governance action drew scrutiny after the exploit.

What is confirmed next

At this stage, the confirmed facts in the source material are limited to the chain freeze, the unsigned transfer at restart, and the later movement of the escaped refund to Osmosis. The seized 1,227,121 ATOM remains at the signerless Cosmos address identified in the report.

The article did not describe any final recovery process beyond the restart action, nor did it indicate a change to the hub’s security status. What has been stated so far is that Cosmos Hub itself was not compromised, while assets tied to Neutron were the ones affected.

Source: Cryptopolitan