Neutron Halted After Governance Vote Empties Astroport and Drop Contracts; Cosmos Hub Pauses to Contain ATOM
On 22 September 2026, two Cosmos networks stopped producing blocks. Neutron halted first. The Cosmos Hub followed later the same morning.
The events are connected, but they are not the same incident. Neutron was the chain on which a governance proposal transferred admin rights over third-party contracts, after which those contracts were migrated and drained. The Hub was paused by validators as a precaution after a large amount of ATOM arrived from Neutron. Officials say the Hub’s own software was not exploited.
This article sets out what is confirmed, what on-chain analysis currently shows, and what remains undecided.
Official position
Neutron-side communications said an attack had been conducted against Astroport on Neutron and that the chain was halted to prevent further harm. An investigation is under way. Astroport said the incident may have exposed admin control of its contracts and advised users to withdraw liquidity from Astroport on all chains until further notice.
Cosmos Hub stated:
- validators temporarily halted the network to mitigate ATOM losses from a governance exploit on Neutron
- the Hub itself is not affected
- wallets holding impacted funds are being identified and isolated
- the community will decide what to do with those funds before operations resume
Osmosis, Noble, Axelar, dYdX and Ethereum continued to produce blocks.
What kind of incident this is
This does not match the usual pattern of a DeFi exploit (a pricing bug, a reentrancy, or an infinite mint).
On-chain reconstruction published by researcher @Rarma_ — built from Neutron, Cosmos Hub, Noble, Axelar, dYdX, Osmosis and Ethereum data — describes a passed Neutron governance proposal that changed the admin of eleven mainnet contracts, followed by contract migrations and withdrawals. Those steps were executed by the chain after the vote closed.
In other words: the state machine did what a successful proposal instructed it to do.
Proposal 9
Proposal 9, submitted on 19 September 2026 at 02:24:49 UTC (block 61,595,975), was titled “AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration.”
The written summary described a research framework for AI agents and a controlled takeover experiment. The executable payload was eleven MsgUpdateAdmin messages aimed at live contracts, including Astroport liquidity and staking contracts and Drop liquid-staking contracts.
It was filed as an expedited proposal:
- three-day voting period instead of seven
- 67% approval threshold instead of 50%
- 1,000,000 NTRN deposit instead of 300,000
An earlier filing, Proposal 7, contained the same eleven messages. It was cancelled by the proposer and resubmitted as Proposal 9.
Before the vote, those contracts were not administered by Neutron’s x/gov module. Astroport contracts sat under Astroport’s own governance (astroport.satellite / astro-assembly v3.0.1). Drop contracts sat under Drop’s own admin. Under CosmWasm, a passed chain-governance proposal can still change contract admin even when x/gov is not the current admin.
That design point is central. The attacker did not need Astroport’s or Drop’s keys. The attacker needed a successful Neutron vote.
How the vote passed
Tally recorded at close:
| Result | Amount (NTRN) |
|---|---|
| Yes | 37,313,263.48 |
| No | 8,088,351.38 |
| No-with-veto | 170,212.01 |
| Abstain | 0.07 |
| Turnout | 45,571,826.94 of 136,848,756.54 bonded (33.30%, quorum 30%) |
| Yes share of votes cast | 81.878% |
Fifty-four vote transactions were cast. One validator voted: Quokka Stake, No. Neutron’s active set is eleven validators.
Two delegator accounts accounted for 98.38% of the Yes vote:
neutron1ekgfga6vv4zdrrjn3dux6f62fuzektfndgaehm— 31,620,400 NTRN (84.74% of Yes)neutron15m3hh904d0cwe4t69ec2w5cmc8535gkxwhgrp5— 5,088,065.40 NTRN (13.64% of Yes)
Without those two wallets, turnout would have missed quorum.
Cosmos counts voting power at the end of the voting period, not when the vote is signed. The first wallet voted Yes while holding about 100 NTRN. On 22 September, between 01:43 and 02:13 UTC, it received 20,000 USDC, bought 31,627,304.38 NTRN, and delegated 31,620,000 NTRN. Voting closed at 02:24:49 UTC — 11 minutes 39 seconds after the delegation.
Purchase cost recorded on-chain: 20,199.00 USDC, or about $0.00063866 per NTRN.
The NTRN was bought from Astroport pools. Two of those pools were among the contracts emptied shortly afterwards. The NTRN/USDC pool was later swept holding 20,323.92 USDC, more than the 16,966.16 USDC paid into it. Net cost of that block of votes, after the sweep, is close to zero.
Twelve addresses voted no-with-veto. Combined they held 0.374% of bonded stake.
Market context: ATOM was trading near $1.74 on 22 September. NTRN had been printing in the $0.00028–$0.00082 range. At those marks, Neutron’s entire bonded supply was worth on the order of $100,000, while the contracts sitting on the chain held several million dollars of other assets.
Execution after the vote
At 01:18:03 UTC — before the vote closed — code_id 5399 was uploaded, with instantiate permission restricted to the uploader.
When Proposal 9 executed at 02:24:49 UTC, eleven contracts changed admin.
Between 02:38:30 and 03:02:37 UTC, ten contracts were migrated to code 5399 with the message {"migrate_to_v2":{}}. The new binary exposes a withdraw_all function that the original Astroport and Drop contracts do not have. Each migration was followed by a withdrawal to the attacker.
After migration, contracts that had identified as astroport-staking v2.3.0 identified as neutron-migration-test-vault v2.0.0.
Astroport Treasury had its admin changed but was not migrated. It remains on code_id 893.
Pool monitors would not have seen a swap or a broken curve. The code that owned the balances was replaced.
Assets withdrawn
Recorded over 194 blocks:
| Asset | Amount |
|---|---|
| USDC | 2,852,311.71 |
| ATOM | 1,723,180.29 |
| dATOM | 1,592,481.67 |
| ASTRO | 370,318,691.39 |
| NTRN | 95,196,289.99 |
| DYDX | 803,955.14 |
| WETH | 20.09 |
| wstETH | 15.99 |
| ECLIP | 429.16 |
Of the ATOM, 1,589,711.92 came from Drop’s converter and 115,878.18 from Drop’s withdrawal manager. Only 17,590.19 came from an Astroport pair. Almost 99% of the ATOM was Drop’s. That is the portion that reached the Cosmos Hub.
Headline mark used in the reconstruction: about $9.4 million. That figure mixes liquid assets, frozen assets, and illiquid tokens. It should not be read as cash already spent.
Where funds moved
A single Cosmos key appears on Neutron, Hub, Noble, Axelar, dYdX and Osmosis.
USDC. Six IBC transfers on channel-30 to Noble, then Circle CCTP burns to Ethereum. 1,180,004.61 USDC minted on Ethereum. Neutron’s IBC rate limiter rejected further USDC sends. Reconciliation:
2,852,311.71 swept − 1,180,010 bridged − 1,000 sent on Neutron = 1,671,301.71 USDC still on Neutron.
wstETH / WETH. Routed via Axelar and Squid. About 15.99 wstETH arrived on Ethereum, unwrapped to ~19.90 stETH and sold for ~19.90 WETH.
ATOM. Four THORChain streaming swaps from the Hub toward native ETH, with memos naming Ethereum address 0xe149310eB8b1b3D9C471CcD81819D393621fBA5c. Two completed payouts totalled 191.72 ETH. A fourth stream of about 200,000 ATOM was still unsettled when the reconstruction was written. After refunds, 1,227,121.37 ATOM remained on the Hub address cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n.
ETH cold storage. 1 + 500 + 170 = 671 ETH moved to 0xEF6c5A31df984c8569236a0AbC1f27580E2a5D54 (nonce 0). Snapshot mark: about $1.84 million. Two lookalike 0xEF6c…5D54 addresses that sent dust are address-poisoning bots, not the cold wallet.
DYDX. 803,955.14 DYDX left Neutron. A large share later consolidated into dydx10sdnqxvrwe3mhducn6plyewul84edgd47rfnfe, which has the pattern of a custodial deposit address. If that is an exchange, it is the most recoverable liquid slice.
What can still move
| Category | Mark (snapshot) | Status |
|---|---|---|
| 671 ETH + working ETH | ~$1.85 million | Liquid |
| 803,955 DYDX | ~$107,000 | Liquid; possibly freezeable |
| Spendable now | ~$1.96 million | About 21% of the $9.4m headline |
| 1,227,121 ATOM on Hub | ~$2.15 million at ~$1.75 | Frozen while Hub is halted |
| Unsettled THORChain stream | ~$351,000 | Unsettled |
| Remainder on Neutron (dATOM, USDC, ASTRO, NTRN, WETH) | ~$4.99 million marked | Frozen while Neutron is halted |
The Neutron column is the weakest mark. The same address holds about 81% of all dATOM. ASTRO and NTRN are marked against thin external float. The USDC still on Neutron ($1.67 million) is a real Noble voucher. Whether users see it again depends on whether Neutron restarts with or without a state reversal of the ten migrations.
That decision has not been published.
The two halts
Neutron — 07:43:55 UTC, last block 61,635,573. Validators were prevoting at 69.23% voting power but precommitting at 27.46%. That pattern is a coordinated stop, not a crash. It is what kept the remaining Neutron balances from leaving.
Cosmos Hub — 11:18:16 UTC, last block 33,086,740. This was not the Gaia v28.2.0 upgrade. That upgrade had already applied at height 33,073,000. Forty-one of 180 validators, holding 37.17% of voting power, were not prevoting. The remainder sat at 62.83%, below the 66.67% needed to finalize a block.
Hub communications describe an operational pause to isolate ATOM, not a consensus failure of the Hub protocol.
Why the structure allowed this
Two conditions sat on top of each other.
First, NTRN’s market value had fallen far below the value locked in contracts on Neutron. Buying enough stake to dominate a low-turnout expedited vote cost $20,199.
Second, chain governance could rewrite admin on contracts that already had their own governance. Protocol-level multisigs and DAO contracts did not bind the chain’s x/gov module.
Any CosmWasm application on a chain with that policy faces the same question: not only who holds the contract admin today, but what a controlling share of chain governance currently costs.
Practical notes for holders
- Funds already in Astroport or Drop contracts on Neutron cannot move while the chain is halted.
- Astroport has asked users to withdraw liquidity on other deployments if they still can.
- Do not respond to recovery messages or connect wallets to unofficial “claim” sites.
- Do not copy Ethereum addresses from transaction-history lookalikes.
- Follow @cosmoshub, Astroport, and Neutron contributor channels for the restart decision.
What happens next
Two governance and validator decisions will determine the final loss figure.
On Neutron: whether the chain restarts from the halted state or from a repaired state that reverses the migrations.
On the Cosmos Hub: what is done with the isolated 1.23 million ATOM before block production resumes.
Until those decisions are published, the only loss that is already final in cash terms is the portion that reached Ethereum and completed THORChain payouts — on current marks, about $2 million, plus whatever of the DYDX cannot be frozen.
Token amounts above are on-chain integers. Dollar figures are a 22 September 2026 snapshot. Official post-mortems from Neutron, Astroport, Drop and the Hub should be treated as the last word when they appear.
Grok Ai used for research and polish this article based on facts and numbers on X .