Cosmos Hub offline for over a day after Neutron governance exploit

On Tuesday, validators of the Cosmos Hub stopped block production following a governance attack on Neutron that initially caused $9.5 million in losses.

From that amount, roughly 20% was successfully taken by the attacker. The rest remained stuck on networks that had been halted.

Block production on Cosmos Hub resumed at 12:00 UTC on Wednesday, meaning the network was down for more than 24 hours after stopping at block height 33086740.

This recent event is the third security incident for the broader Cosmos network in the past several months.

Cosmos Hub validators will restart the network at 12:00 UTC on September 23 (08:00 EDT).

Reminder: the Hub itself was not exploited and no funds were impacted apart from the assets moved from Neutron. More details https://t.co/6LlvUjpKIj

— Cosmos Hub (@cosmoshub) September 23, 2026

The governance attack

A harmful governance proposal, described as an "AI Agent Takeover," was passed on Neutron. This chain within the Cosmos ecosystem entered its "long-term maintenance phase" earlier in the year.

Through the proposal, the attacker gained control over two applications on Neutron — Astroport and Drop — and drained contracts of assets valued at $4.9 million and $4.4 million respectively.

The attacker reportedly spent only $20,199 to obtain the NTRN tokens necessary to carry out the vote.

The response

In response to the exploit, Neutron was paused, which trapped roughly $5 million in assets.

Consequently, Cosmos Hub validators also chose to halt, thereby securing an additional 1.2 million ATOM — worth over $2.2 million — in the attacker's address. The planned restart includes a queued refund of that trapped ATOM balance.

The hacker's Ethereum address contains $1.8 million, and another transaction worth more than $300,000 is pending on THORChain. That sum is set to be returned to the Cosmos Hub address when the network restarts.

Chaos in the Cosmos ecosystem

In late August, a flaw in Cosmos Labs' Cosmos EVM module caused protocol-level exploits across four blockchains.

The disclosure process drew sharp criticism from one of the impacted projects, KiiChain, which described the loss of $9 million in its KII tokens as "avoidable."

Earlier this month, the Cosmos-based exchange Osmosis disclosed that an exploit of Nomic's bridge on June 25 had created 40 nBTC — worth $3.6 million at the time — without backing, leaving Osmosis' allBTC partially (36%) unbacked.