Skip to content
THREATWIRE

2026-09-22 · record inc_0008 · updated 2026-10-19

Neutron governance takeover: Astroport and Drop contracts drained

A $20,199 stake purchase passed governance proposal 9 and handed 11 contracts to an attacker; ten were emptied.

AstroportDropNeutronCosmos HubComponent: Neutron native governance, contract admin rights

Event
Official statement
Root cause
Official statement
Loss
Official statement

Current status

Funds in recovery multisigs; return vote pending.

Timeline

  1. 2026-09-22 02:24 UTCProposal 9 vote closes.
  2. 2026-09-22 07:43 UTCNeutron validators halt the chain.
  3. 2026-09-22 11:18 UTCCosmos Hub halts at block 33,086,740.
  4. 2026-09-23 12:00 UTCHub restarts on Gaia v28.3.0; ATOM moved to a recovery multisig.
  5. 2026-10-12Cosmos Hub proposal 1058 passes.

Root cause

Per the post-mortem, native governance could change the admin of any contract and executed immediately; a late stake purchase decided the vote.

Basis: official post-mortem · verified by us against that source

Classes: Governance takeover

Impact: loss and recovery

Liquidity of Astroport pools, Drop converter and withdrawal manager, and Neutron investor vesting.

Reported loss

$6.24M

USD basis: Neutron post-mortem, investigation-time prices. Other estimates reach about $9.5M.

Recovered or returned

$4.01M (partial)

About 64% secured in recovery multisigs; return vote pending.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.

Public reproduction file

No public reproduction file is recorded for this incident.

Remediation and defensive indicators

  • Contracts restored to original code and admins; governance restricted to upgrades and text proposals; recovery multisigs. (reported)

Defensive lessons from the class

  • Price the attack: what does it cost to win a vote versus what the vote controls.
  • Add delays and veto windows after a vote passes.

Sources

  • Official post-mortem

    Neutron (Solva): Neutron governance attack post-mortem

    Published 2026-09-29 · retrieved 2026-10-19 · Linked from Neutron governance proposal 10.

  • Official statement

    Cosmos Labs (Cosmos Hub forum): Neutron governance attack, Cosmos Hub response and recovery update

    Published 2026-09-25 · retrieved 2026-10-19

  • Independent analysis

    SlowMist: Initial loss estimate (about $9.3M)

    retrieved 2026-10-19

  • Media report

    iTokenly: Neutron governance takeover hack entry

    retrieved 2026-10-19

  • Media report

    Protos: Initial loss estimate (about $9.5M)

    retrieved 2026-10-19

Similar incidents

Read the full written analysis

Method, uncertainty and corrections

Still unknown

  • Attacker identity
  • Fate of funds on Ethereum

Where sources disagree

  • Loss: $6.24M (post-mortem), $4.4M (IBC outflow), $9.3M to $9.5M (early estimates).

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.