- Cosmos Hub validators halted block production for over 24 hours following a governance attack on the ecosystem chain Neutron.
- The attack exploited a malicious “AI Agent Takeover” proposal, draining approximately $9.3 million from two applications before the chain was paused.
- The attacker was only able to extract about 20% of the stolen funds, with over $7 million worth of assets trapped on the halted networks.
Cosmos Hub validators halted block production on Tuesday after a governance attack on the ecosystem chain Neutron, which initially caused losses of $9.5 million. The attacker was only able to extract around 20% of that sum, with the remainder stuck on halted networks.
Block production resumed at 12:00 UTC on Wednesday, leaving Cosmos Hub offline for over 24 hours after halting at block height 33086740. This latest incident marks the third security scare in recent months for the wider Cosmos ecosystem.
A malicious “AI Agent Takeover” governance proposal was passed on Neutron, a Cosmos-ecosystem chain. The proposal allowed the attacker to take control of two Neutron-based applications, draining assets worth $4.9 million from Astroport and $4.4 million from Drop.
The attacker reportedly spent just $20,199 to acquire the NTRN tokens needed to pass the vote. In response, Neutron was paused, trapping an estimated $5 million worth of assets.
Consequently, Cosmos Hub validators decided to halt, securing a further 1.2 million ATOM (over $2.2 million) held in the attacker’s address. The scheduled restart includes a queued refund of the trapped ATOM balance.
The Hacker’s Ethereum address holds $1.8 million, with a further transaction worth over $300,000 pending on THORChain. This pending transaction is set to be refunded to the Cosmos Hub address upon restart.
In late August, a bug in Cosmos Labs’ Cosmos EVM module led to protocol-level exploits on four blockchains. The disclosure procedure was heavily criticized by the affected project KiiChain, which dubbed the loss of $9 million worth of its KII tokens “avoidable.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
