Cosmos Hub Restarts and Moves $2.1 Million in Stolen Tokens Out of an Attacker’s Wallet

HACK OR EXPLOITCosmos Hub Restarts and Moves$2.1 Million in Stolen Tokens Out ofan Attacker’s Wallet34IMPORTANCECLOSED3NEWS MEDIA4PIECESSep 23, 2026 16:12blockboard.net
In Hacks and security

Cosmos Hub validators restarted the chain on Wednesday morning after a halt that lasted nearly 25 hours. In the first post-restart block, 1,227,121 ATOM moved out of the wallet tied to the Neutron governance attacker, and one report said the wallet owner signed nothing for that transfer. Later, a governance proposal to return the seized ATOM drew a near-unanimous veto by Friday afternoon.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

What this rests on

Claim by claim, with its source
✓
Cosmos Hub resumed block production on Wednesday morning after validators had stopped the network for nearly 25 hours.
Cosmos Hub Restarts and Moves $2.1 Million in Stolen Tokens Out of an Attacker’s
✓
In the first block after the restart, 1,227,121 ATOM, worth about $2.1 million, moved out of the attacker-linked wallet.
Cosmos Hub Restarts and Moves $2.1 Million in Stolen Tokens Out of an Attacker’s
✓
The chain recorded the post-restart move in block 33,086,741, and the wallet owner did not sign the transfer.
Cosmos Hub restart moves 1.23 million ATOM out of Neutron exploiter's wallet wit
✓
The transfer was made into a recovery multisig after the Neutron governance attack that drained protocol liquidity, while Cosmos Hub itself was not attacked and user funds were unaffected.
Cosmos Hub Moves 1.227 Million ATOM Into Recovery Multisig

Market reaction

We track ATOM, but we only have 0 price points in that window. The series is stored every half hour, so newer events will have it. Computing it from two points would not be a reaction, it would be a coincidence.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 23 16:12
+3 h 42 m
Sep 23 19:54
+1 d 16 h
Sep 25 08:49
CR Cryptopolitan context
Its angle: cosmos1z8pq5c, compromised, controlling; with quotes
+2 d 3 h
Sep 25 20:05
Unchained context
Its angle: unjustifiably, community, astroport; with quotes

Thefts of a similar size

WhenWhat happenedFigure
4 months ago Aztec Connect · Forged Proof incident $2.1M
2.2 years ago ETHTrustFund · Treasury Misappropriation incident $2.1M
2.6 years ago Unizen · Arbitrary External Call incident $2.1M
2.6 years ago Shido Network incident $2.1M
2.7 years ago Starlay Finance incident $2.1M

4197 incidents stored · 693 were as large as this one or larger ($2.1M)