Cosmos Hub Resumes After 24.5-Hour Halt With ATOM Recovery Patch

Cosmos Hub resumed block production after an approximately 24.5-hour halt, with validators using a software update to move 1,227,121.37 ATOM linked to a Neutron governance attack into a recovery multisig.

The Hub stopped at block height 33,086,740 on Sept. 22, 2026, after about 1.7 million ATOM from Neutron reached the network. Validators representing more than one-third of voting power halted their nodes to limit further movement of the tokens. Cosmos Hub itself was not exploited, and no Hub user funds were affected.

Cosmos Hub uses CometBFT, a consensus system that requires more than two-thirds of voting power to commit a block. If at least one-third of voting power withholds votes, the remaining validators cannot meet that threshold. Block production can stop, but that voting threshold does not allow the participating validators to rewrite the ledger.

Validators restarted the Hub at 8 a.m. ET (12:00 UTC) Sept. 23, ending the halt. At 8:06 a.m. ET (12:06 UTC), Gaia v28.3.0 applied a one-time software change at block height 33,086,741. It placed 1,227,121.37 ATOM into a 4-of-6 multisig controlled by community signers. The change was accepted through the software running on the validators; it was not a transaction signed by the address that had held the tokens.

The change did not secure all of the ATOM involved. After the restart, 168,990.9 ATOM arrived at the attacker’s address through a THORChain refund and was moved out. The recovered balance remains in the multisig. A later Cosmos Hub governance proposal is planned to authorize its transfer to Neutron’s recovery multisig.

The halt also showed why signing a transaction does not guarantee it will be processed: validators still need to produce blocks for transactions to be included.