A $20,000 vote took over Astroport and Drop on Neutron. Here is what the post-mortem says

What happened

Nobody broke a smart contract here. The attacker won a vote.

On 22 September 2026 an expedited governance proposal on Neutron, the CosmWasm chain in the Cosmos ecosystem, passed with a large "yes" tally. Its title talked about an AI-agent research project. Its payload was eleven messages that changed the admin of eleven live contracts to the proposer: eight Astroport contracts, two Drop contracts and Neutron's investor vesting contract.

With admin rights in hand, the attacker swapped the code of ten of them for their own and withdrew every balance. Neutron's validators halted the chain the same morning. The Cosmos Hub, where part of the loot had been sent, halted too.

What is confirmed

The main accounts are Neutron's post-mortem, written by its security maintainer Solva and published on 29 September, and the Cosmos Labs update on the Cosmos Hub forum. Neutron's own governance proposal 10 repeats the key numbers. Times are UTC.

The vote

• Proposal 9 was filed on 19 September on the expedited track. Two earlier proposals with the same payload had failed: one was rejected and one was withdrawn after heavy opposition.
• According to the post-mortem, a wallet linked to the attacker spent 20,199 USDC on about 31.6 million NTRN and staked it minutes before voting closed at 02:24 on 22 September. That stake made up most of the "yes" vote, and the post-mortem says the proposal would not have reached quorum without it.
• Neutron had recently moved from DAO-based governance to the Cosmos SDK's native module. That module could change the admin of any contract, and it executed passed proposals immediately.

The drain

• Between roughly 02:38 and 03:04 the attacker migrated ten contracts to code that exposed a "withdraw everything" function, and emptied them. The eleventh, the Astroport treasury, changed hands but was not drained.
• The post-mortem values what was withdrawn at about $6.24 million, using the prices it recorded during the investigation. It counts Drop's dATOM at zero, because the ATOM that backed it was taken too and counting both would double the figure.
• Taken: about 2.85M USDC, 1.72M ATOM, 803,955 DYDX, 95.2M NTRN, 370.3M ASTRO and small amounts of axlWETH and wstETH.

The response

• Neutron's validators halted the chain at about 07:43. Part of the ATOM had already reached the Hub, where the attacker was swapping it through THORChain.
• Hub validators halted at block 33,086,740 at about 11:18. A day later they restarted on a patched Gaia release, v28.3.0, with a one-time state change that moved the 1,227,121 ATOM still sitting on the attacker's Hub address into a 4-of-6 validator multisig. Block production resumed at 12:00 on 23 September.
• Cosmos Labs says about 500,000 ATOM had already gone through THORChain and is not recoverable. A THORChain refund of 168,990.9 ATOM reached the attacker after the restart and was moved out. Both tranches are treated as lost.
• Neutron relaunched on 25 September with a recovery release. It restored all eleven contracts to their original code and admins, moved the stolen funds still on Neutron and the purchased stake into a recovery multisig, and locked both attacker accounts.

Recovery, per proposal 10

Neutron's own table shows full recovery of ASTRO, NTRN and dATOM, about 71% of the ATOM, about 59% of the USDC and about 70% of the axlWETH. Nothing came back of the DYDX, and almost nothing of the wstETH. The post-mortem counts about $4.01 million, 64% of the total, as secured.

The Cosmos Hub passed its own proposal, 1058, on 12 October to let the Hub multisig send the ATOM to Neutron's recovery multisig. Proposal 10 then asks Neutron governance to return the funds to the original contracts. As of 19 October it was still in its voting period, so the money has not yet gone back.

How it worked

The weak point was a design choice. On Neutron, a passed chain-level governance proposal could rewrite the admin of any contract, even contracts that Neutron's governance did not control. Astroport's contracts answered to Astroport's own governance and Drop's to Drop's admin. None of that mattered once the chain's own vote could override it.

That turned the question "can someone break Astroport?" into "can someone win a Neutron vote?". The answer depended on the price of a token with thin liquidity and a lot of idle holders. The attacker did not need keys or an exploit. They needed enough NTRN, at the right minute, with nobody left to outvote them.

The attacker then used the standard CosmWasm migration tool for a hostile purpose. Because the contracts now ran different code, pool monitors saw no broken curve and no odd swaps. The thing that held the balances had simply been replaced.

What is not known

• Who the attacker is. No attribution has been published.
• How much of the money that left Neutron can still be traced. The post-mortem says an Ethereum collection wallet held a large ETH balance at publication time, but has not published its fate.
• Final loss figures. They depend on the price basis. The post-mortem uses the prices from its own investigation and the Hub uses ATOM-denominated counts.
• Whether the remaining losses will be covered by anyone. Proposal 10 states plainly that it does not compensate unrecovered losses.
• How and when users will be able to withdraw. Each protocol decides that through its own admin. Astroport and Drop have said how their contracts will pay out, with different haircuts per asset.

Where sources disagree

Loss figures vary widely, and the gap is mostly about method.

• Neutron's post-mortem counts about $6.24M of assets withdrawn.
• A figure of about $4.4M from a former Neutron contributor matches what left Neutron over IBC before the halt.
• SlowMist recorded about $9.3M, and Protos about $9.5M, in early estimates before the post-mortem. We do not know how those were counted.

ThreatWire uses the post-mortem figure in the tracker and shows the others here for context. Credora's earlier "about $9M" is in the same upper range.

Lessons

• Treat chain-level governance as a root key. If a vote can rewrite any contract, the cost of a vote is the cost of every contract on the chain.
• Thin governance tokens are cheap to rent or buy. A 3-day expedited track with a last-minute stake leaves almost no time to respond.
• Quorum and timing rules matter. The post-mortem says quorum was met only because of the late stake. Delays after a large late stake, or a veto window, would have changed this.
• Do not leave a chain in "maintenance mode" without a governance review. Neutron had recently reworked its governance.
• Rehearse the halt. The response worked because validators on two chains coordinated within hours. Cosmos Labs published a minute-by-minute record, which is useful reading.

What users should do

If you held liquidity in Astroport, Drop's dATOM, or xASTRO on Neutron, follow each protocol's official channels. Withdrawals go through the original interfaces, but some pools are being restored with uneven balances and will be withdraw-only first. Expect a haircut on some assets.

Be wary of anyone who messages you offering to speed up a refund. The Hub and Neutron say funds only move through governance votes.

Sources: the Neutron post-mortem, the Cosmos Labs Hub update, the text of Neutron proposal 10, and coverage from iTokenly, SlowMist and Protos, none of which are linked here. We have not verified the on-chain figures ourselves.