Neutron Governance Attack: How $20,000 in Voting Power Seized $9.5M in Contracts and Halted Cosmos Hub
An attacker reportedly spent approximately $20,200 acquiring NTRN voting power, then passed a malicious governance proposal that gave them control over Astroport and Drop contracts holding roughly $9.5 million. Neutron halted, followed by Cosmos Hub, where some stolen assets had been bridged. After approximately 24.5 hours, Hub validators restarted with a software update that transferred 1,227,121 ATOM from the attacker's address into a validator-controlled recovery multisig. Around $1.8 million had reached Ethereum in initial reporting, and a further 168,990.9 ATOM escaped after restart. Cosmos Hub itself was not exploited.
This article is published for educational and informational purposes only. It does not constitute legal, financial, or investment advice. Nothing in this article should be relied upon as the sole basis for any decision relating to the security, investment value, or legal standing of any protocol or digital asset.
This is a preliminary analysis based on publicly available reporting and open-source code review. An official post-mortem has not yet been published by the affected protocol at time of writing. Any code samples included are illustrative reconstructions for educational purposes only and do not represent confirmed exploit code. This article will be updated when authoritative technical disclosure is available.
Information published on any code vulnerabilities must not be used to attack, test, or probe any protocol or system without explicit authorisation from its owner. Use of this content is subject to our Terms of Service and Privacy Policy.
What happened
On September 22, 2026, an attacker passed a malicious governance proposal on Neutron, a Cosmos chain that had been running in maintenance mode since the summer. The proposal, titled "AI Agent Takeover", handed the attacker administrative control over application contracts deployed on the chain. According to Protos, the attacker spent approximately $20,199 acquiring the NTRN voting power needed to pass it.
With admin rights in hand, the attacker deployed malicious code to the affected contracts and drained their assets. Protos identified two applications as the main victims: Astroport, with approximately $4.9 million drained, and Drop, with approximately $4.4 million. The roughly $9.5 million headline figure describes the initial attack exposure. It is not the amount the attacker successfully cashed out.
Neutron halted, which trapped some of the stolen assets on-chain. It could not protect funds that had already been bridged elsewhere. As Cosmos Labs documented, approximately 1.73 million ATOM reached Cosmos Hub, prompting Hub validators to halt the chain at block 33,086,740.
Cosmos Hub stayed down for approximately 24.5 hours and resumed at 12:00 UTC on September 23 running Gaia v28.3.0. The upgrade performed a narrowly scoped, one-time transfer of the attacker's remaining 1,227,121.37 ATOM into a 4-of-6 recovery multisig controlled by Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. This was not a rollback of the Hub's transaction history.
Not all of the ATOM was caught. Approximately 500,000 ATOM had already been swapped through THORChain before the halt. A subsequent THORChain refund of 168,990.9 ATOM arrived after the restart, outside the scope of the one-time transfer, and the attacker moved it out. Protos separately reported roughly $1.8 million sitting in the attacker's Ethereum address at the time of its initial coverage.
Root cause
No contract bug was needed. The attacker used the chain's own governance process, exactly as designed, to grant themselves powers that governance was entitled to grant. The vulnerability was economic and operational: control over contracts holding millions of dollars could be bought for about $20,000 of voting power.
A maintenance-mode chain with live value
On March 16, Neutron announced its transition to long-term support: Hadron Labs' maintenance would end on June 30, and the blockchain would continue producing blocks with community support. "Maintenance-mode chain" is therefore a more accurate description than "defunct chain." Blocks kept coming, and applications like Astroport and Drop kept holding user funds, but the active stewardship that usually watches governance for hostile proposals had been wound down.
That combination is the core of the problem. The value secured by governance stayed high while the cost of controlling governance fell. When a token's market value and voter participation both decline, the capital required to reach quorum and a passing majority declines with them. The application contracts did not get any cheaper to drain.
Governance as the contract admin
On CosmWasm chains like Neutron, a contract's admin can migrate it to new code. When governance holds or can reassign that admin role, a passed proposal is equivalent to a full code upgrade of every contract within its reach. The sequence below is an illustrative reconstruction of the attack path, not the attacker's actual transactions.
// 1. Acquire enough NTRN voting power to pass a proposal
cost_of_voting_power = ~$20,199
// 2. Submit and pass "AI Agent Takeover"
// Effect: attacker gains admin control over application contracts
proposal.messages = [ update_admin(contract, attacker), ... ]
// 3. Deploy malicious code and migrate the contracts
migrate(astroport_contract, malicious_code_id)
migrate(drop_contract, malicious_code_id)
// 4. Drain assets through the new code
astroport_drained = ~$4.9M
drop_drained = ~$4.4M
initial_exposure = ~$9.5M
// Every step passes the chain's own checks.
// Governance authorised it; the contracts obeyed their new admin.Where the ATOM went
The Cosmos Labs accounting reconciles closely. Of the approximately 1.73 million ATOM that reached the Hub, roughly 500,000 had left through THORChain before validators halted the chain. The remaining 1,227,121.37 ATOM was moved to the recovery multisig by the Gaia v28.3.0 upgrade. The THORChain refund of 168,990.9 ATOM then landed after the restart and escaped.
reached_cosmos_hub = ~1,730,000 ATOM
swapped_via_thorchain = ~500,000 ATOM // before the halt
hub_halt_block = 33,086,740
halt_duration = ~24.5 hours
recovered_to_multisig = 1,227,121.37 ATOM // Gaia v28.3.0, one-time transfer
multisig_threshold = 4 of 6
signers = Nansen, Keplr, Enigma, Silknodes, Kiln, Polkachu
thorchain_refund = 168,990.9 ATOM // arrived after restart, escapedWhat could have been done
- Remove governance admin rights before entering maintenance mode. A chain winding down active development should first shrink what governance can do. Revoking or freezing admin rights over high-value application contracts, or handing them to the applications' own multisigs, means a captured governance process can no longer migrate them to malicious code.
- Price governance attacks against the value they can reach. Governance security is a ratio: the cost to pass a proposal versus the value that proposal can move. Applications should track this ratio continuously. When around $20,000 of voting power can reach over $9 million in contracts, the applications holding that value should be treated as exposed and migrate or restrict accordingly.
- Add timelocks and veto paths for privilege-changing proposals. Any proposal that changes contract admins or migrates code should face an extended execution delay after passing, with an emergency veto held by a security council or the affected applications. A delay gives defenders time to pull liquidity, warn users, or cancel execution before funds move.
- Monitor governance as an attack surface, not just a process. Sudden accumulation of voting power, a proposal from a new or freshly funded address, and messages that touch contract admins are all detectable signals. Automated alerts on these patterns are especially important on chains where the core team is no longer watching proposals day to day.
- Give applications on maintenance-mode chains a clear exit plan. Astroport and Drop were holding live value on a chain whose primary maintainer had stepped back. Applications in that position should either migrate to an actively maintained environment or take full ownership of their own upgrade keys so their security no longer depends on the chain's governance.
- Prepare scoped recovery tooling for connected chains in advance. Cosmos Hub validators coordinated a halt, a targeted upgrade, and a 4-of-6 recovery multisig within about a day. That response worked because it was narrow. Pre-agreed playbooks that also cover in-flight cross-chain refunds, like the THORChain refund that arrived after restart, would close the gap that let 168,990.9 ATOM escape.
Lessons for the industry
The Neutron incident shows that a chain does not need to be broken to be dangerous. Every component worked as specified: governance passed a proposal with enough votes, the proposal granted admin rights, and the contracts accepted new code from their new admin. The failure was in the assumptions around those mechanisms, specifically the assumption that acquiring a governance majority would always be too expensive or too visible to be worth attempting.
Those assumptions erode as a chain winds down. Token prices fall, voters stop participating, and the team that once reviewed every proposal moves on. Meanwhile, the value held by applications on the chain can stay high for months. Sunsetting a chain is a security event, and it should come with its own threat model: what can governance still do, who is still watching, and what does it cost to take control.
The Cosmos Hub response is also worth studying on its own terms. Validators halted quickly, then restarted with a one-time transfer that moved only the attacker's remaining balance rather than rewriting history. That restraint matters for a chain whose credibility rests on not intervening. It was not complete: roughly 500,000 ATOM had already left through THORChain, and a refund arriving after restart slipped through. The lesson for interconnected ecosystems is that containment has to account for funds in motion across bridges and swap venues, not only balances sitting at a known address.
Finally, loss figures in incidents like this need care. The $9.5 million figure is the initial exposure across Astroport and Drop. The 1.73 million ATOM that reached the Hub is not the amount recovered. The $1.8 million in the attacker's Ethereum address was a snapshot, not a final tally. Reporting each number for what it actually measures is the only way to judge whether the response worked and what it still missed.