# Cosmos Hub Moves 1.227 Million ATOM Into Recovery Multisig

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/24234
Published: 2026-09-25T18:17:51.000Z
Updated: 2026-09-25T18:17:51.000Z
Section: Technology

> The transfer followed a Neutron governance attack that drained protocol liquidity. Cosmos Hub itself was not attacked, and user funds were unaffected.

Cosmos Hub transferred 1,227,121 Cosmos (ATOM) into a recovery multisig after a Neutron governance attack drained liquidity from protocols including Astroport, while the Hub itself and its users were not affected.

About 1.73 million ATOM moved to Cosmos Hub during the incident. Before the chain was halted, roughly 500,000 ATOM was exchanged for Ether (ETH) through THORChain. Another 168,990.9 ATOM was returned by THORChain after the restart and then moved out of the attacker-controlled address.

The 1,227,121 ATOM still held in the attacker-controlled address was placed in a 4-of-6 multisig when Cosmos Hub resumed operations. The funds can move only after explicit authorization through a Cosmos Hub governance proposal.

Validators halted the chain at block height 33,086,740. Cosmos Hub restarted about 24.5 hours later with Gaia v28.3.0; more than 67% of voting power had approved the patch before the restart, and about 96% of validators have now upgraded.

Neutron has resumed operations and deployed mitigation measures. Its recovery team expects to submit a proposal covering the funds within the next week.